{
  "@id": "urn:uuid:59c60fa9-9f06-4d46-8c13-0eedb3ba4de8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T03:24:57.825240+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 is NOT PRESENT in Spring Security 5.1.5.RELEASE. The vulnerability allowed bypassing security constraints via path parameters (semicolon-delimited parameters in URL paths like /path;param=value). The upstream vendor fix (commit 7d97adc687 by Luke Taylor, October 2010) introduced the HttpFirewall infrastructure with two protection mechanisms: (1) DefaultHttpFirewall wraps requests ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 is NOT PRESENT in Spring Security 5.1.5.RELEASE. The vulnerability allowed bypassing security constraints via path parameters (semicolon-delimited parameters in URL paths like /path;param=value). The upstream vendor fix (commit 7d97adc687 by Luke Taylor, October 2010) introduced the HttpFirewall infrastructure with two protection mechanisms: (1) DefaultHttpFirewall wraps requests ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6 due to a race condition in RunAsManager that stored Authentication in a shared SecurityContext accessible across threads. The target Spring Security 5.1.5.RELEASE already contains both upstream vendor fixes (SEC-1750 from July 2011 and SEC-1967 from July 2012) that address this vulnerability. These fixes create t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6 due to a race condition in RunAsManager that stored Authentication in a shared SecurityContext accessible across threads. The target Spring Security 5.1.5.RELEASE already contains both upstream vendor fixes (SEC-1750 from July 2011 and SEC-1967 from July 2012) that address this vulnerability. These fixes create t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.1.5.RELEASE. The vulnerability pattern does not exist because the upstream vendor (Spring Security) fixed it in 2011-2012 (commits 5238ba0e26, a087e828a6, and 538e75ce1b by Luke Taylor), well before version 5.1.5.RELEASE was released in 2019. The fix validates redirect locations for CR/LF characters via the Fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.1.5.RELEASE. The vulnerability pattern does not exist because the upstream vendor (Spring Security) fixed it in 2011-2012 (commits 5238ba0e26, a087e828a6, and 538e75ce1b by Luke Taylor), well before version 5.1.5.RELEASE was released in 2019. The fix validates redirect locations for CR/LF characters via the Fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 is NOT present in Spring Security 5.1.5.RELEASE. The vulnerability involved deserializing entire SecurityContext objects from untrusted sources in RMI remoting, enabling attackers to execute arbitrary code via malicious serialized objects (Proxy instances, AOP interfaces, etc.). The target code contains the upstream fix (commit b48fc53fa2 by Luke Taylor, May 2011) which replaced S...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is NOT present in Spring Security 5.1.5.RELEASE. The vulnerability involved deserializing entire SecurityContext objects from untrusted sources in RMI remoting, enabling attackers to execute arbitrary code via malicious serialized objects (Proxy instances, AOP interfaces, etc.). The target code contains the upstream fix (commit b48fc53fa2 by Luke Taylor, May 2011) which replaced S..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.1.5.RELEASE is not affected by CVE-2012-5055. The timing attack vulnerability (username enumeration via response-time differences) was fixed in the upstream release before TuxCare onboarded the project. The fix commit c076f0f2e190c73a17379d05935c2c81657adee9 by Rob Winch (VMware) is present in HEAD and implements the SEC-2056 mitigation: dummy password validation wh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.1.5.RELEASE is not affected by CVE-2012-5055. The timing attack vulnerability (username enumeration via response-time differences) was fixed in the upstream release before TuxCare onboarded the project. The fix commit c076f0f2e190c73a17379d05935c2c81657adee9 by Rob Winch (VMware) is present in HEAD and implements the SEC-2056 mitigation: dummy password validation wh..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2014-3527 affects Spring Security's CAS Proxy ticket authentication when service URLs are derived from untrusted HTTP headers. The target repository (Spring Security 5.1.5.RELEASE) is NOT AFFECTED because the fix (SEC-2688) was already present in the upstream release before TuxCare onboarded it. The vulnerable code pattern does not exist at HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 affects Spring Security's CAS Proxy ticket authentication when service URLs are derived from untrusted HTTP headers. The target repository (Spring Security 5.1.5.RELEASE) is NOT AFFECTED because the fix (SEC-2688) was already present in the upstream release before TuxCare onboarded it. The vulnerable code pattern does not exist at HEAD."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 5.1.5.RELEASE is not affected by CVE-2016-5007. The vulnerability affected Spring Security 3.2.x, 4.0.x, and 4.1.0, where differences in URL pattern matching between Spring Security and Spring MVC could allow authorization bypass. The fixes (MvcRequestMatcher for consistent URL matching, and encoded slash blocking in firewalls) were introduced in Spring Security 4.1.1.RELEASE (2016) by the upstream vendor. The target version 5.1.5.RELEASE, onboarded by TuxCare, already contains these upstream fixes. Both defense mechanisms are present and active by default: MvcRequestMatcher is available for use, and StrictHttpFirewall (the default firewall) blocks URL-encoded slashes by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 5.1.5.RELEASE is not affected by CVE-2016-5007. The vulnerability affected Spring Security 3.2.x, 4.0.x, and 4.1.0, where differences in URL pattern matching between Spring Security and Spring MVC could allow authorization bypass. The fixes (MvcRequestMatcher for consistent URL matching, and encoded slash blocking in firewalls) were introduced in Spring Security 4.1.1.RELEASE (2016) by the upstream vendor. The target version 5.1.5.RELEASE, onboarded by TuxCare, already contains these upstream fixes. Both defense mechanisms are present and active by default: MvcRequestMatcher is available for use, and StrictHttpFirewall (the default firewall) blocks URL-encoded slashes by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2016-9879 is NOT present in Spring Security 5.1.5.RELEASE. The vulnerability allowed bypassing security constraints via URL-encoded slash (%2f/%2F) in path parameters. The upstream vendor fix (commit 666e356ebc by Rob Winch, Dec 2016) added containsInvalidUrlEncodedSlash() validation to DefaultHttpFirewall, rejecting requests with encoded slashes. This fix shipped in Spring Security 3.2.10/4.1.4/4.2.1 and was already present when TuxCare onboarded 5.1.5.RELEASE (commit a3538cebaa, Mar 2019). Target code at HEAD contains the complete defense at DefaultHttpFirewall.java lines 49, 60-63, 91-101.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "CVE-2016-9879 is NOT present in Spring Security 5.1.5.RELEASE. The vulnerability allowed bypassing security constraints via URL-encoded slash (%2f/%2F) in path parameters. The upstream vendor fix (commit 666e356ebc by Rob Winch, Dec 2016) added containsInvalidUrlEncodedSlash() validation to DefaultHttpFirewall, rejecting requests with encoded slashes. This fix shipped in Spring Security 3.2.10/4.1.4/4.2.1 and was already present when TuxCare onboarded 5.1.5.RELEASE (commit a3538cebaa, Mar 2019). Target code at HEAD contains the complete defense at DefaultHttpFirewall.java lines 49, 60-63, 91-101.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 5.1.5.RELEASE is not affected by CVE-2017-4995. The vulnerability concerned unsafe Jackson deserialization when SecurityJackson2Modules.enableDefaultTyping() enabled unrestricted default typing, allowing arbitrary code execution through deserialization gadgets. The upstream fix (commit 5dee8534cd by Rob Winch) replaced unrestricted enableDefaultTyping() with a whitelisting mechanism (WhitelistTypeIdResolver) that validates classes before deserialization, rejecting non-whitelisted classes without Jackson annotations or mixins. This fix was already included in Spring Security 5.1.5.RELEASE before TuxCare onboarded it (first TuxCare commit a3538cebaa). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 5.1.5.RELEASE is not affected by CVE-2017-4995. The vulnerability concerned unsafe Jackson deserialization when SecurityJackson2Modules.enableDefaultTyping() enabled unrestricted default typing, allowing arbitrary code execution through deserialization gadgets. The upstream fix (commit 5dee8534cd by Rob Winch) replaced unrestricted enableDefaultTyping() with a whitelisting mechanism (WhitelistTypeIdResolver) that validates classes before deserialization, rejecting non-whitelisted classes without Jackson annotations or mixins. This fix was already included in Spring Security 5.1.5.RELEASE before TuxCare onboarded it (first TuxCare commit a3538cebaa). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2018-1199. The vulnerability affects versions 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1. The target version (5.1.5.RELEASE) is well beyond the affected range. The upstream fix (StrictHttpFirewall) was introduced in commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 by Rob Winch in October 2017 and shipped in Spring Security ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2018-1199. The vulnerability affects versions 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1. The target version (5.1.5.RELEASE) is well beyond the affected range. The upstream fix (StrictHttpFirewall) was introduced in commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 by Rob Winch in October 2017 and shipped in Spring Security ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 5.1.5.RELEASE-tuxcare.1 is not affected by CVE-2018-15801. The vulnerability (JWT issuer validation bypass via URL object comparison) was fixed in upstream Spring Security 5.1.2.RELEASE (November 2018) and the fix was already present in the upstream 5.1.5.RELEASE (April 2019) when TuxCare onboarded it. The vulnerable code pattern does not exist in the target. Fix authored by upstream developer josh.cummings@gmail.com in commit 5478b74116.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "The target Spring Security 5.1.5.RELEASE-tuxcare.1 is not affected by CVE-2018-15801. The vulnerability (JWT issuer validation bypass via URL object comparison) was fixed in upstream Spring Security 5.1.2.RELEASE (November 2018) and the fix was already present in the upstream 5.1.5.RELEASE (April 2019) when TuxCare onboarded it. The vulnerable code pattern does not exist in the target. Fix authored by upstream developer josh.cummings@gmail.com in commit 5478b74116.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x and older. The vulnerable class does not exist in Spring Security 5.1.5.RELEASE. It was removed in Spring Security 5.0.0 (Nov 2017) and replaced with NoOpPasswordEncoder. The replacement class uses Java's String.equals() method which correctly returns false when encodedPassword is null, preventing authentication bypass. The input (null encoded password) is received but the Brief's Goal (authentication success) is never reached due to equals() null handling. Tests from 2015 explicitly verify this safe behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x and older. The vulnerable class does not exist in Spring Security 5.1.5.RELEASE. It was removed in Spring Security 5.0.0 (Nov 2017) and replaced with NoOpPasswordEncoder. The replacement class uses Java's String.equals() method which correctly returns false when encodedPassword is null, preventing authentication bypass. The input (null encoded password) is received but the Brief's Goal (authentication success) is never reached due to equals() null handling. Tests from 2015 explicitly verify this safe behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 5.1.5.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2019-3795. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used to configure a SecureRandom instance - specifically, calling setSeed() before any random bytes were generated would cause the user-provided seed to REPLACE the entire internal RNG state rather than suppleme...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 5.1.5.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2019-3795. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used to configure a SecureRandom instance - specifically, calling setSeed() before any random bytes were generated would cause the user-provided seed to REPLACE the entire internal RNG state rather than suppleme..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "action_statement": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976: BCrypt integer overflow vulnerability NOT present. The vulnerability requires `int rounds = 1 << 31` which overflows to -2147483648, causing zero salt rounds. The target uses `long rounds = 1L << 31` (line 490 of BCrypt.java), which correctly computes 2147483648 without overflow. The fix was introduced in commit 14a5135ac3 (2012-07-04) by upstream contributor Joseph Walton, pred...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976: BCrypt integer overflow vulnerability NOT present. The vulnerability requires `int rounds = 1 << 31` which overflows to -2147483648, causing zero salt rounds. The target uses `long rounds = 1L << 31` (line 490 of BCrypt.java), which correctly computes 2147483648 without overflow. The fix was introduced in commit 14a5135ac3 (2012-07-04) by upstream contributor Joseph Walton, pred..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.5.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.5.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout removes persisted authentication, including serialized session copies. The persistence filter saves the cleared context after logout in web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:108. The session wrapper removes the stored context when authentication changes from present to null in web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:348, preventing authentication from surviving logout even when session invalidation is disabled.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout removes persisted authentication, including serialized session copies. The persistence filter saves the cleared context after logout in web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:108. The session wrapper removes the stored context when authentication changes from present to null in web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:348, preventing authentication from surviving logout even when session invalidation is disabled."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:57.825240+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38810 affects the @AuthorizeReturnObject annotation in Spring Security 6.3.0 and 6.3.1. This annotation does not exist in Spring Security 5.1.5.RELEASE. The feature was introduced in March 2024 (commit d169d5a835), long after the 5.1.5.RELEASE version. Since the annotation and its authorization mechanism are completely absent from the target codebase, the vulnerability pattern cannot m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38810 affects the @AuthorizeReturnObject annotation in Spring Security 6.3.0 and 6.3.1. This annotation does not exist in Spring Security 5.1.5.RELEASE. The feature was introduced in March 2024 (commit d169d5a835), long after the 5.1.5.RELEASE version. Since the annotation and its authorization mechanism are completely absent from the target codebase, the vulnerability pattern cannot m..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.5.RELEASE does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.5.RELEASE does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.5.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.5.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the One-Time Token (OTT) authentication feature. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.3.x, several major versions after 5.1.5. The target codebase does not process one-time authentication tokens and therefore cannot be affected by the TOCTOU race condition described in CVE-2026-22751.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the One-Time Token (OTT) authentication feature. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.3.x, several major versions after 5.1.5. The target codebase does not process one-time authentication tokens and therefore cannot be affected by the TOCTOU race condition described in CVE-2026-22751."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T03:24:34.107780+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the InetAddressMatchers utility class that is the subject of CVE-2026-59277. The vulnerability concerns the matchInternal() and matchExternal() builders of InetAddressMatchers failing to recognize 0.0.0.0 and :: as internal addresses. Exhaustive search confirms this class, its methods, and the org.springframework.security.util.matcher package do no...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the InetAddressMatchers utility class that is the subject of CVE-2026-59277. The vulnerability concerns the matchInternal() and matchExternal() builders of InetAddressMatchers failing to recognize 0.0.0.0 and :: as internal addresses. Exhaustive search confirms this class, its methods, and the org.springframework.security.util.matcher package do no..."
    }
  ]
}