{
  "@id": "urn:uuid:343d182e-857b-4f14-bd04-ebda56faac47",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:55:00.104909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T21:05:25.610146+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (semicolons in URLs). The target version 5.1.4.RELEASE already contains the upstream fix (SEC-1584) committed in October 2010 by Luke Taylor. The fix introduces HttpFirewall with two implementations: DefaultHttpFirewall strips path parameters from UR...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (semicolons in URLs). The target version 5.1.4.RELEASE already contains the upstream fix (SEC-1584) committed in October 2010 by Luke Taylor. The fix introduces HttpFirewall with two implementations: DefaultHttpFirewall strips path parameters from UR..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:40:03.588885+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target version 5.1.4.RELEASE already contains the upstream fixes (SEC-1750 from 2011 and SEC-1967 from 2012) that eliminate the race condition vulnerability. The vulnerable pattern\u2014storing RunAs Authentication in a shared SecurityContext\u2014is not present. Instead, the code creates isolated SecurityContext inst...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target version 5.1.4.RELEASE already contains the upstream fixes (SEC-1750 from 2011 and SEC-1967 from 2012) that eliminate the race condition vulnerability. The vulnerable pattern\u2014storing RunAs Authentication in a shared SecurityContext\u2014is not present. Instead, the code creates isolated SecurityContext inst..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:16:35.969046+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.1.4.RELEASE is not affected by CVE-2011-2732. The CRLF injection vulnerability in logout redirect functionality was fixed in upstream Spring Security 2.0.7 and 3.0.6 (2011). Version 5.1.4.RELEASE already contains the upstream fix: FirewalledResponse validates and rejects all redirect locations containing CR or LF characters at runtime. This defense is properly wired...",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.1.4.RELEASE is not affected by CVE-2011-2732. The CRLF injection vulnerability in logout redirect functionality was fixed in upstream Spring Security 2.0.7 and 3.0.6 (2011). Version 5.1.4.RELEASE already contains the upstream fix: FirewalledResponse validates and rejects all redirect locations containing CR or LF characters at runtime. This defense is properly wired..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T22:54:33.596048+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 describes a Java deserialization vulnerability where Spring Security's ContextPropagatingRemoteInvocation serialized the entire SecurityContext object from client to server in RMI calls, allowing arbitrary code execution via malicious serialized objects (e.g., java.lang.Proxy with InvocationHandler, DefaultListableBeanFactory). The target repository (Spring Security 5.1.4.RELEASE)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 describes a Java deserialization vulnerability where Spring Security's ContextPropagatingRemoteInvocation serialized the entire SecurityContext object from client to server in RMI calls, allowing arbitrary code execution via malicious serialized objects (e.g., java.lang.Proxy with InvocationHandler, DefaultListableBeanFactory). The target repository (Spring Security 5.1.4.RELEASE)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T21:23:00.263988+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.1.4.RELEASE. The fix for SEC-2056 was shipped in upstream Spring Security 3.1.3 (per CVE metadata) and is present in the target version. The fix commit c076f0f2e1 by Rob Winch (VMware) was included in the upstream 5.1.4.RELEASE before TuxCare onboarded this version. The target code contains the complete timing attack ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.1.4.RELEASE. The fix for SEC-2056 was shipped in upstream Spring Security 3.1.3 (per CVE metadata) and is present in the target version. The fix commit c076f0f2e1 by Rob Winch (VMware) was included in the upstream 5.1.4.RELEASE before TuxCare onboarded this version. The target code contains the complete timing attack ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T17:46:50.706673+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 5.1.4.RELEASE is not affected by CVE-2014-3527. The vulnerability involved CAS proxy ticket authentication using untrusted HTTP request headers (Host, Server Name, Server Port) to construct the service URL, allowing attackers to bypass access control restrictions. The fix (commit 934937d9c1dc20c396b96c08310b72cfa627acbf by Rob Winch, July 2014) was already present in the upstream Spring Security 5.1.4.RELEASE when TuxCare onboarded it in September 2026. The fixed code correctly derives service URL components from pre-configured ServiceProperties instead of HttpServletRequest headers.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target Spring Security 5.1.4.RELEASE is not affected by CVE-2014-3527. The vulnerability involved CAS proxy ticket authentication using untrusted HTTP request headers (Host, Server Name, Server Port) to construct the service URL, allowing attackers to bypass access control restrictions. The fix (commit 934937d9c1dc20c396b96c08310b72cfa627acbf by Rob Winch, July 2014) was already present in the upstream Spring Security 5.1.4.RELEASE when TuxCare onboarded it in September 2026. The fixed code correctly derives service URL components from pre-configured ServiceProperties instead of HttpServletRequest headers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:39:18.885622+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2016-5007 describes URL pattern-matching discrepancies between Spring Security and Spring MVC that allow authorization bypass. The vulnerability has two components: (1) semantic pattern-matching differences (e.g., Spring Security's AntPathRequestMatcher for \"/path\" doesn't match \"/path/\" or \"/path.html\" while Spring MVC does), and (2) URL-encoded slash bypasses (e.g., \"/a/b;%2f1/c\" bypassing rules on \"/a/b/c\"). The target Spring Security 5.1.4.RELEASE contains both upstream fixes: MvcRequestMatcher (commit e4c13e3c0e, July 2016) provides Spring MVC-aligned pattern matching, and DefaultHttpFirewall (commit 666e356ebc, Dec 2016) blocks URL-encoded slashes by default. Both fixes were authored by Rob Winch (rwinch@gopivotal.com) and shipped in the upstream 5.1.4.RELEASE that TuxCare onboarded (commit 9efa782ade). The vulnerable code patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 describes URL pattern-matching discrepancies between Spring Security and Spring MVC that allow authorization bypass. The vulnerability has two components: (1) semantic pattern-matching differences (e.g., Spring Security's AntPathRequestMatcher for \"/path\" doesn't match \"/path/\" or \"/path.html\" while Spring MVC does), and (2) URL-encoded slash bypasses (e.g., \"/a/b;%2f1/c\" bypassing rules on \"/a/b/c\"). The target Spring Security 5.1.4.RELEASE contains both upstream fixes: MvcRequestMatcher (commit e4c13e3c0e, July 2016) provides Spring MVC-aligned pattern matching, and DefaultHttpFirewall (commit 666e356ebc, Dec 2016) blocks URL-encoded slashes by default. Both fixes were authored by Rob Winch (rwinch@gopivotal.com) and shipped in the upstream 5.1.4.RELEASE that TuxCare onboarded (commit 9efa782ade). The vulnerable code patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Target Spring Security 5.1.4.RELEASE is NOT AFFECTED by CVE-2016-9879. The vulnerability involves URL-encoded slashes (%2f/%2F) bypassing security constraints due to inconsistent servlet container path parameter handling. The fix (validation rejecting encoded slashes in requestURI) was already present in upstream Spring Security 5.1.4.RELEASE, which TuxCare onboarded. The defense code exists in DefaultHttpFirewall.java lines 60-63 and 91-101, is enabled by default, and was authored by Rob Winch (Pivotal) in the upstream 3.2.10/4.1.4/4.2.1 releases, then merged into the 5.x line before 5.1.4.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Target Spring Security 5.1.4.RELEASE is NOT AFFECTED by CVE-2016-9879. The vulnerability involves URL-encoded slashes (%2f/%2F) bypassing security constraints due to inconsistent servlet container path parameter handling. The fix (validation rejecting encoded slashes in requestURI) was already present in upstream Spring Security 5.1.4.RELEASE, which TuxCare onboarded. The defense code exists in DefaultHttpFirewall.java lines 60-63 and 91-101, is enabled by default, and was authored by Rob Winch (Pivotal) in the upstream 3.2.10/4.1.4/4.2.1 releases, then merged into the 5.x line before 5.1.4.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 5.1.4.RELEASE is not affected by CVE-2017-4995. The whitelisting fix for Jackson deserialization was already present in the upstream 5.1.4.RELEASE when TuxCare onboarded it. The vulnerable pattern (unrestricted enableDefaultTyping) is not present; the target has the complete WhitelistTypeIdResolver protection that validates class names against a whitelist before allowing deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "The target Spring Security 5.1.4.RELEASE is not affected by CVE-2017-4995. The whitelisting fix for Jackson deserialization was already present in the upstream 5.1.4.RELEASE when TuxCare onboarded it. The vulnerable pattern (unrestricted enableDefaultTyping) is not present; the target has the complete WhitelistTypeIdResolver protection that validates class names against a whitelist before allowing deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:49:36.466974+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.4.RELEASE is NOT vulnerable to CVE-2018-1199. The upstream vendor fix (StrictHttpFirewall) was already present in the 5.1.4.RELEASE when TuxCare onboarded it. The defense blocks semicolons (;, %3b, %3B) in all URL path components, preventing path parameter bypass attacks. Fix authored by Rob Winch (rwinch@users.noreply.github.com) in commit 0eef5b4b425ab42b9fa0fde1a3f36a37b9...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.4.RELEASE is NOT vulnerable to CVE-2018-1199. The upstream vendor fix (StrictHttpFirewall) was already present in the 5.1.4.RELEASE when TuxCare onboarded it. The defense blocks semicolons (;, %3b, %3B) in all URL path components, preventing path parameter bypass attacks. Fix authored by Rob Winch (rwinch@users.noreply.github.com) in commit 0eef5b4b425ab42b9fa0fde1a3f36a37b9..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target version is 5.1.4.RELEASE-tuxcare.2, which already contains the upstream fix. The vulnerability involved using Java URL.equals() for JWT issuer validation, which can perform DNS resolution and normalization causing unintended matches between different issuer URLs. The fix changed from URL object comparison to string comparison. This fix was authored by Josh Cummings (josh.cummings@gmail.com) and shipped in upstream Spring Security 5.1.2+. TuxCare onboarded version 5.1.4.RELEASE which already contained this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target version is 5.1.4.RELEASE-tuxcare.2, which already contains the upstream fix. The vulnerability involved using Java URL.equals() for JWT issuer validation, which can perform DNS resolution and normalization causing unintended matches between different issuer URLs. The fix changed from URL object comparison to string comparison. This fix was authored by Josh Cummings (josh.cummings@gmail.com) and shipped in upstream Spring Security 5.1.2+. TuxCare onboarded version 5.1.4.RELEASE which already contained this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:27:39.447287+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 5.1.4.RELEASE is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was completely removed from the codebase in the upstream Spring Security 5.0 release (October 23, 2017), approximately 1.5 years before version 5.1.4.RELEASE was published (February 13, 2019). The CVE explicitly states it affects \"versions 4.2.x up to 4.2.12, and older unsupported versions\" \u2014 the target version 5.1.4.RELEASE is newer and does not contain the affected code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.1.4.RELEASE is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was completely removed from the codebase in the upstream Spring Security 5.0 release (October 23, 2017), approximately 1.5 years before version 5.1.4.RELEASE was published (February 13, 2019). The CVE explicitly states it affects \"versions 4.2.x up to 4.2.12, and older unsupported versions\" \u2014 the target version 5.1.4.RELEASE is newer and does not contain the affected code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T12:59:03.895277+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T12:59:03.895277+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "action_statement": "Vulnerability CVE-2020-5408 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T12:59:03.895277+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:16:00.155922+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2022-22976. The vulnerable code pattern (int rounds = 1 << log_rounds causing integer overflow at work factor 31) was never present in this version. The target has the safe implementation using long arithmetic (long rounds = roundsForLogRounds(log_rounds) where roundsForLogRounds returns 1L << log_rounds) that shipped in the original upstream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2022-22976. The vulnerable code pattern (int rounds = 1 << log_rounds causing integer overflow at work factor 31) was never present in this version. The target has the safe implementation using long arithmetic (long rounds = roundsForLogRounds(log_rounds) where roundsForLogRounds returns 1L << log_rounds) that shipped in the original upstream..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T12:59:03.895277+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:19:00.050397+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.4.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.4.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Configuration installs the persistence filter before logout (SecurityContextConfigurer.java:85; FilterComparator.java:68). Logout clears the holder, whose subsequent access creates an empty context (SecurityContextLogoutHandler.java:70; ThreadLocalSecurityContextHolderStrategy.java:40). Repository loading installs a response wrapper and captures the loaded context\u2019s authentication before logout modifies it (HttpSessionSecurityContextRepository.java:126, same file:325). The enclosing filter saves the resulting empty context in its finally block using that wrapped response (SecurityContextPersistenceFilter.java:98). Saving removes the session attribute when the initial authentication was nonnull, independently of context identity, covering deserialized authenticated contexts even when session invalidation is disabled (HttpSessionSecurityContextRepository.java:348).",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Configuration installs the persistence filter before logout (SecurityContextConfigurer.java:85; FilterComparator.java:68). Logout clears the holder, whose subsequent access creates an empty context (SecurityContextLogoutHandler.java:70; ThreadLocalSecurityContextHolderStrategy.java:40). Repository loading installs a response wrapper and captures the loaded context\u2019s authentication before logout modifies it (HttpSessionSecurityContextRepository.java:126, same file:325). The enclosing filter saves the resulting empty context in its finally block using that wrapped response (SecurityContextPersistenceFilter.java:98). Saving removes the session attribute when the initial authentication was nonnull, independently of context identity, covering deserialized authenticated contexts even when session invalidation is disabled (HttpSessionSecurityContextRepository.java:348)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:56:06.186310+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 5.1.4.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 5.1.4.RELEASE-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:53:33.389442+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2024-38810. The vulnerability is specific to the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3.0 and does not exist in version 5.1.4.RELEASE. The CVE describes a bug where this annotation fails to enforce authorization checks, but since the annotation is absent from the target version, the vulnerability cannot...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2024-38810. The vulnerability is specific to the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3.0 and does not exist in version 5.1.4.RELEASE. The CVE describes a bug where this annotation fails to enforce authorization checks, but since the annotation is absent from the target version, the vulnerability cannot..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T12:59:03.895277+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2025-22223. The vulnerability exists in UniqueSecurityAnnotationScanner, a component introduced in Spring Security 6.x alongside the @EnableMethodSecurity annotation. Version 5.1.4 uses a completely different architecture: @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.g...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2025-22223. The vulnerability exists in UniqueSecurityAnnotationScanner, a component introduced in Spring Security 6.x alongside the @EnableMethodSecurity annotation. Version 5.1.4 uses a completely different architecture: @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.g..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T12:59:03.895277+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2025-22234 is a timing attack regression introduced by the CVE-2025-22228 fix. The target Spring Security 5.1.4.RELEASE (SHA e659e352de) never received the CVE-2025-22228 backport that added strict password length checking in BCrypt, therefore it does not have the timing attack vulnerability that CVE-2025-22234 addresses. The timing attack mitigation in DaoAuthenticationProvider remains int...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 is a timing attack regression introduced by the CVE-2025-22228 fix. The target Spring Security 5.1.4.RELEASE (SHA e659e352de) never received the CVE-2025-22228 backport that added strict password length checking in BCrypt, therefore it does not have the timing attack vulnerability that CVE-2025-22234 addresses. The timing attack mitigation in DaoAuthenticationProvider remains int..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:45:50.947674+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.4.RELEASE does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.4.RELEASE does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T11:35:00.150371+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.4.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.4.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T12:59:03.895277+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T06:08:36.782808+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.4.RELEASE does not contain the One-Time Token (OTT) authentication feature introduced in version 6.x. The vulnerable JdbcOneTimeTokenService class and all related OneTimeToken components (OneTimeTokenAuthenticationToken, OneTimeTokenService interface, InMemoryOneTimeTokenService) do not exist in this version. CVE-2026-22751 concerns a TOCTOU race condition in JdbcOneTimeToke...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.4.RELEASE does not contain the One-Time Token (OTT) authentication feature introduced in version 6.x. The vulnerable JdbcOneTimeTokenService class and all related OneTimeToken components (OneTimeTokenAuthenticationToken, OneTimeTokenService interface, InMemoryOneTimeTokenService) do not exist in this version. CVE-2026-22751 concerns a TOCTOU race condition in JdbcOneTimeToke..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T12:59:03.895277+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers utility class with matchInternal/matchExternal builders) does not exist in this version. This feature was introduced in Spring Security 6.x or later, years after the 5.1.4 release (January 2019). The target repository contains only IpAddressMatcher, a different class that performs subn...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers utility class with matchInternal/matchExternal builders) does not exist in this version. This feature was introduced in Spring Security 6.x or later, years after the 5.1.4 release (January 2019). The target repository contains only IpAddressMatcher, a different class that performs subn..."
    }
  ]
}