{
  "@id": "urn:uuid:6702c40b-d6eb-46fc-9e36-23c2a8d43561",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:16:00.061099+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-core 5.6.10-tuxcare.11. False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product.",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-core 5.6.10-tuxcare.11. CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID Provider side. NVD records it with vendor and product \\\"n/a\\\" behind a single unversioned CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's March 2007 myOpenID security-fix announcement and to the openid.net security mailing list of the same month, where the reporter states the problem had to be fixed on the myOpenID server. The reported mechanism - using cached tokens and an existing Provider session to forcibly log a user into a site, disclose their personal information to it, and add that site permanently to the user's trusted-sites list - is Provider-side behaviour; a trusted-sites auto-approval list exists only at the Provider and has no counterpart in a relying party. The corresponding GitHub advisory, GHSA-3x88-xvgr-m6fg, is unreviewed and lists no affected package in any ecosystem.The openid module of Spring Security implements only the relying-party (consumer) role. OpenIDConsumer and its single implementation OpenID4JavaConsumer wrap openid4java's ConsumerManager to begin and end a consumption, and OpenIDAuthenticationFilter together with OpenIDAuthenticationProvider turn the result into an Authentication. The only openid4java packages referenced anywhere in the source tree are consumer, discovery, message and association; there is no use of org.openid4java.server, no ServerManager, no OpenID Provider implementation, and no trusted-sites or \\\"always trust\\\" handling of any kind, nor are any openid4java sources vendored into the tree. Nor could the library have been affected when the issue was disclosed: the advisory was published in March 2007, while the earliest OpenID code in this project was contributed in April 2007 and the openid4java-based consumer only appeared in July 2007. The vulnerability therefore does not apply to Spring Security in any version, including 5.6.10.",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID Provider side. NVD records it with vendor and product \\\"n/a\\\" behind a single unversioned CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's March 2007 myOpenID security-fix announcement and to the openid.net security mailing list of the same month, where the reporter states the problem had to be fixed on the myOpenID server. The reported mechanism - using cached tokens and an existing Provider session to forcibly log a user into a site, disclose their personal information to it, and add that site permanently to the user's trusted-sites list - is Provider-side behaviour; a trusted-sites auto-approval list exists only at the Provider and has no counterpart in a relying party. The corresponding GitHub advisory, GHSA-3x88-xvgr-m6fg, is unreviewed and lists no affected package in any ecosystem.The openid module of Spring Security implements only the relying-party (consumer) role. OpenIDConsumer and its single implementation OpenID4JavaConsumer wrap openid4java's ConsumerManager to begin and end a consumption, and OpenIDAuthenticationFilter together with OpenIDAuthenticationProvider turn the result into an Authentication. The only openid4java packages referenced anywhere in the source tree are consumer, discovery, message and association; there is no use of org.openid4java.server, no ServerManager, no OpenID Provider implementation, and no trusted-sites or \\\"always trust\\\" handling of any kind, nor are any openid4java sources vendored into the tree. Nor could the library have been affected when the issue was disclosed: the advisory was published in March 2007, while the earliest OpenID code in this project was contributed in April 2007 and the openid4java-based consumer only appeared in July 2007. The vulnerability therefore does not apply to Spring Security in any version, including 5.6.10."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (e.g., /admin.html;x=user.html). The target Spring Security 5.6.10-tuxcare.10 is NOT affected because the upstream vendor fix (SEC-1584, commit 7d97adc6) was introduced in October 2010 and shipped in the 5.6.10 release. The fix adds HttpFirewall/Requ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (e.g., /admin.html;x=user.html). The target Spring Security 5.6.10-tuxcare.10 is NOT affected because the upstream vendor fix (SEC-1584, commit 7d97adc6) was introduced in October 2010 and shipped in the 5.6.10 release. The fix adds HttpFirewall/Requ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.10 is NOT affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed by upstream Spring Security in 2011-2012 (SEC-1750 and SEC-1967), long before version 5.6.10 was released. The fixes are present in the target: RunAs authentication is isolated to a new SecurityContext instead of modifying the shared one, and try-finally blocks ensure proper clean...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.10 is NOT affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed by upstream Spring Security in 2011-2012 (SEC-1750 and SEC-1967), long before version 5.6.10 was released. The fixes are present in the target: RunAs authentication is isolated to a new SecurityContext instead of modifying the shared one, and try-finally blocks ensure proper clean..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 5.6.10. The CRLF injection vulnerability was fixed by upstream Spring Security in commit 824464516c (SEC-1790, July 2011), which predates TuxCare's onboarding of version 5.6.10. The target contains comprehensive CR/LF validation in FirewalledResponse that rejects redirect locations containing carriage return or line feed characters, preventing HTT...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 5.6.10. The CRLF injection vulnerability was fixed by upstream Spring Security in commit 824464516c (SEC-1790, July 2011), which predates TuxCare's onboarding of version 5.6.10. The target contains comprehensive CR/LF validation in FirewalledResponse that rejects redirect locations containing carriage return or line feed characters, preventing HTT..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 5.6.10 is NOT affected by CVE-2011-2894. The vulnerable deserialization pattern was removed by upstream fix SEC-1741 (commit b48fc53fa2703c66e0eedc343aa673331117978f) applied by Luke Taylor in May 2011, which shipped in all Spring Security versions from 3.1.0 onwards. The target code uses string-based transmission of principal/credentials instead of serializing SecurityCo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 5.6.10 is NOT affected by CVE-2011-2894. The vulnerable deserialization pattern was removed by upstream fix SEC-1741 (commit b48fc53fa2703c66e0eedc343aa673331117978f) applied by Luke Taylor in May 2011, which shipped in all Spring Security versions from 3.1.0 onwards. The target code uses string-based transmission of principal/credentials instead of serializing SecurityCo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 describes a timing side-channel vulnerability in DaoAuthenticationProvider that allows username enumeration. The vulnerable pattern (no password encoding when user not found) is NOT PRESENT in the target. The fix was authored by Rob Winch (rwinch@vmware.com) from VMware and shipped in upstream Spring Security 3.1.3 (September 2012). Target version 5.6.10 inherited this fix from th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 describes a timing side-channel vulnerability in DaoAuthenticationProvider that allows username enumeration. The vulnerable pattern (no password encoding when user not found) is NOT PRESENT in the target. The fix was authored by Rob Winch (rwinch@vmware.com) from VMware and shipped in upstream Spring Security 3.1.3 (September 2012). Target version 5.6.10 inherited this fix from th..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-04T17:01:56.007074+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. The target Spring Security 5.6.10 is not affected by CVE-2014-3527. The vulnerability (CAS proxy ticket authentication using untrusted HTTP Host header to build service URL) was fixed by upstream vendor (Rob Winch, Pivotal) on 2014-07-24 in commit 934937d9c1. This fix shipped in Spring Security 4.0.0.M2 and is present in all subsequent versions including 5.6.10. The vulnerable pattern (building service URL from HttpServletRequest.getServerName()/getScheme()/getServerPort()) does not exist in the target code - it uses the pre-configured ServiceProperties URL instead.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target Spring Security 5.6.10 is not affected by CVE-2014-3527. The vulnerability (CAS proxy ticket authentication using untrusted HTTP Host header to build service URL) was fixed by upstream vendor (Rob Winch, Pivotal) on 2014-07-24 in commit 934937d9c1. This fix shipped in Spring Security 4.0.0.M2 and is present in all subsequent versions including 5.6.10. The vulnerable pattern (building service URL from HttpServletRequest.getServerName()/getScheme()/getServerPort()) does not exist in the target code - it uses the pre-configured ServiceProperties URL instead."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. The target Spring Security 5.6.10 repository is NOT AFFECTED by CVE-2016-5007. Both primary defenses introduced by the vendor to address URL pattern-matching discrepancies are present in the target: (1) MvcRequestMatcher class that delegates URL matching to Spring MVC's HandlerMappingIntrospector, eliminating pattern-matching differences between Spring Security and Spring MVC; (2) DefaultHttpFirewall enhancement that rejects URL-encoded slashes (%2f/%2F) to prevent container-specific bypasses. These fixes were authored by upstream Spring Security developers (rwinch@gopivotal.com) in 2016 and shipped with the upstream 5.6.10 release before TuxCare onboarding (first TuxCare commit 258ad9ee0d). The vulnerable pattern\u2014authorization bypass via pattern-matching discrepancies\u2014does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target Spring Security 5.6.10 repository is NOT AFFECTED by CVE-2016-5007. Both primary defenses introduced by the vendor to address URL pattern-matching discrepancies are present in the target: (1) MvcRequestMatcher class that delegates URL matching to Spring MVC's HandlerMappingIntrospector, eliminating pattern-matching differences between Spring Security and Spring MVC; (2) DefaultHttpFirewall enhancement that rejects URL-encoded slashes (%2f/%2F) to prevent container-specific bypasses. These fixes were authored by upstream Spring Security developers (rwinch@gopivotal.com) in 2016 and shipped with the upstream 5.6.10 release before TuxCare onboarding (first TuxCare commit 258ad9ee0d). The vulnerable pattern\u2014authorization bypass via pattern-matching discrepancies\u2014does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. The target Spring Security 5.6.10 is not affected by CVE-2016-9879. The vulnerability involves bypassing security constraints via URL-encoded slash characters (%2f/%2F) in request URIs, exploiting servlet container differences in path parameter handling. The fix (commit 666e356ebc) was authored by upstream maintainer Rob Winch and shipped in Spring Security 4.2.1.RELEASE (December 2016), well before version 5.6.10 was released. The fix adds validation in DefaultHttpFirewall.getFirewalledRequest() to detect and reject URIs containing encoded slashes, preventing the bypass. This protection is present in the target at lines 59-62 and 86-94 of DefaultHttpFirewall.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target Spring Security 5.6.10 is not affected by CVE-2016-9879. The vulnerability involves bypassing security constraints via URL-encoded slash characters (%2f/%2F) in request URIs, exploiting servlet container differences in path parameter handling. The fix (commit 666e356ebc) was authored by upstream maintainer Rob Winch and shipped in Spring Security 4.2.1.RELEASE (December 2016), well before version 5.6.10 was released. The fix adds validation in DefaultHttpFirewall.getFirewalledRequest() to detect and reject URIs containing encoded slashes, preventing the bypass. This protection is present in the target at lines 59-62 and 86-94 of DefaultHttpFirewall.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. CVE-2017-4995 does not affect this version. The vulnerability was an unrestricted Jackson deserialization issue in Spring Security 4.2.0-4.2.2 and 5.0.0.M1. The fix was applied upstream in Spring Security 5.0.0.M2 (commit 5dee8534cd by Rob Winch, May 2017), introducing an allowlist-based TypeIdResolver that rejects arbitrary class deserialization. The target version 5.6.10 was released in 2022, long after the fix, and shipped with the protection already in place. The defense mechanism is present and functional in the target at lines 190-274 of SecurityJackson2Modules.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "CVE-2017-4995 does not affect this version. The vulnerability was an unrestricted Jackson deserialization issue in Spring Security 4.2.0-4.2.2 and 5.0.0.M1. The fix was applied upstream in Spring Security 5.0.0.M2 (commit 5dee8534cd by Rob Winch, May 2017), introducing an allowlist-based TypeIdResolver that rejects arbitrary class deserialization. The target version 5.6.10 was released in 2022, long after the fix, and shipped with the protection already in place. The defense mechanism is present and functional in the target at lines 190-274 of SecurityJackson2Modules.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199: Spring Security 5.6.10 is not affected. The vulnerability allows bypassing security constraints via URL path parameters with special encodings (semicolons, encoded slashes/periods) due to inconsistent servlet container handling. The fix (StrictHttpFirewall) is present at FilterChainProxy.java:154 as the default firewall, rejecting requests with forbidden encoded characters before...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199: Spring Security 5.6.10 is not affected. The vulnerability allows bypassing security constraints via URL path parameters with special encodings (semicolons, encoded slashes/periods) due to inconsistent servlet container handling. The fix (StrictHttpFirewall) is present at FilterChainProxy.java:154 as the default firewall, rejecting requests with forbidden encoded characters before..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2 due to JWT issuer validation using URL.equals() which performs DNS resolution, allowing different URLs resolving to the same IP to bypass validation. The target (Spring Security 5.6.10) is NOT affected because the fix (commit 19649db9ce \"Leave Issuer As String\") shipped in upstream version 5.6.0, which TuxCare later onboarded. The current implementation uses string-based comparison (issuer.equals(claimValue.toString())) instead of URL object comparison, eliminating the DNS resolution vulnerability. The fix was authored by upstream maintainer Josh Cummings, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2 due to JWT issuer validation using URL.equals() which performs DNS resolution, allowing different URLs resolving to the same IP to bypass validation. The target (Spring Security 5.6.10) is NOT affected because the fix (commit 19649db9ce \"Leave Issuer As String\") shipped in upstream version 5.6.0, which TuxCare later onboarded. The current implementation uses string-based comparison (issuer.equals(claimValue.toString())) instead of URL object comparison, eliminating the DNS resolution vulnerability. The fix was authored by upstream maintainer Josh Cummings, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. Spring Security 5.6.10 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from the codebase by upstream in October 2017 (before version 5.0.0). The target version 5.6.10 does not contain this class. The replacement password encoders (NoOpPasswordEncoder, DelegatingPasswordEncoder, etc.) do not exhibit the vulnerable pattern where null encoded passwords can match the string \"null\". Additionally, DaoAuthenticationProvider includes upstream protections that reject null credentials before they reach any password encoder.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.6.10 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from the codebase by upstream in October 2017 (before version 5.0.0). The target version 5.6.10 does not contain this class. The replacement password encoders (NoOpPasswordEncoder, DelegatingPasswordEncoder, etc.) do not exhibit the vulnerable pattern where null encoded passwords can match the string \"null\". Additionally, DaoAuthenticationProvider includes upstream protections that reject null credentials before they reach any password encoder.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 is NOT present in Spring Security 5.6.10-tuxcare.10. The vulnerable code pattern (calling nextBytes() only when no seed is provided) does not exist in the target. The upstream Spring Security fix (commit 9c1eac79e2) was already included in the 5.6.10 release when TuxCare onboarded it. The current code correctly calls nextBytes() BEFORE setSeed(), ensuring that custom seeds supplem...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 is NOT present in Spring Security 5.6.10-tuxcare.10. The vulnerable code pattern (calling nextBytes() only when no seed is provided) does not exist in the target. The upstream Spring Security fix (commit 9c1eac79e2) was already included in the 5.6.10 release when TuxCare onboarded it. The current code correctly calls nextBytes() BEFORE setSeed(), ensuring that custom seeds supplem..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:54.137004+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. Version 5.6.10 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected below 5.3.2), NVD (affected below 5.3.2), CVE record (affected below 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Version 5.6.10 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected below 5.3.2), NVD (affected below 5.3.2), CVE record (affected below 5.3.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "action_statement": "Vulnerability CVE-2020-5408 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. The target Spring Security 5.6.10 is NOT AFFECTED by CVE-2021-22119. The upstream fix (commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71 by Craig Andrews) that limits OAuth2 authorization request storage to one per session is present in the target repository. The fix was shipped in the upstream Spring Security 5.6.10 release before TuxCare onboarded it (verified by checking the fix is an ancestor of commit 258ad9ee0d8b35c28bd51f6ad01e771a4efb431b \"Initial Tuxcare setup for 5.6.10\"). The defense blocks the attack by storing only a single OAuth2AuthorizationRequest directly in the session (overwriting previous requests) instead of accumulating them in an unbounded Map, preventing resource exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target Spring Security 5.6.10 is NOT AFFECTED by CVE-2021-22119. The upstream fix (commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71 by Craig Andrews) that limits OAuth2 authorization request storage to one per session is present in the target repository. The fix was shipped in the upstream Spring Security 5.6.10 release before TuxCare onboarded it (verified by checking the fix is an ancestor of commit 258ad9ee0d8b35c28bd51f6ad01e771a4efb431b \"Initial Tuxcare setup for 5.6.10\"). The defense blocks the attack by storing only a single OAuth2AuthorizationRequest directly in the session (overwriting previous requests) instead of accumulating them in an unbounded Map, preventing resource exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 is NOT present in the target. The vulnerability involves an integer overflow in BCrypt's crypt_raw method when log_rounds=31. In vulnerable code, `rounds = 1 << 31` overflows to negative in Java, causing zero encryption rounds. The target contains the upstream fix from Spring Security 5.6.4 (commit a40f73521c0), which shipped in the 5.6.10 release. The fix changes rounds from int...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 is NOT present in the target. The vulnerability involves an integer overflow in BCrypt's crypt_raw method when log_rounds=31. In vulnerable code, `rounds = 1 << 31` overflows to negative in Java, causing zero encryption rounds. The target contains the upstream fix from Spring Security 5.6.4 (commit a40f73521c0), which shipped in the 5.6.10 release. The fix changes rounds from int..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. CVE-2022-22978 affects Spring Security RegexRequestMatcher when regex patterns using `.` (dot) don't include Pattern.DOTALL flag, allowing authorization bypass via newline characters in request paths. The fix (commit c6461d61ba from May 2022) changes DEFAULT from 0 to Pattern.DOTALL. Analysis confirms this fix is already present in the target repository at HEAD (6d428b8b71). The fix was shipped in upstream Spring Security 5.6.10 release before TuxCare's initial setup (commit 258ad9ee0d). Target version 5.6.10-tuxcare.10 inherits the fix from upstream - verdict is not_affected with upstream attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 affects Spring Security RegexRequestMatcher when regex patterns using `.` (dot) don't include Pattern.DOTALL flag, allowing authorization bypass via newline characters in request paths. The fix (commit c6461d61ba from May 2022) changes DEFAULT from 0 to Pattern.DOTALL. Analysis confirms this fix is already present in the target repository at HEAD (6d428b8b71). The fix was shipped in upstream Spring Security 5.6.10 release before TuxCare's initial setup (commit 258ad9ee0d). Target version 5.6.10-tuxcare.10 inherits the fix from upstream - verdict is not_affected with upstream attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. Target version 5.6.10 is not affected by CVE-2022-31692. The vulnerability (authorization bypass via FORWARD/INCLUDE dispatcher types when AuthorizationFilter incorrectly extends OncePerRequestFilter) was fixed in upstream Spring Security 5.6.9 by commit 1f481aafff. TuxCare onboarded version 5.6.10, which already contained the upstream fix. The vulnerable code pattern is not present in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Target version 5.6.10 is not affected by CVE-2022-31692. The vulnerability (authorization bypass via FORWARD/INCLUDE dispatcher types when AuthorizationFilter incorrectly extends OncePerRequestFilter) was fixed in upstream Spring Security 5.6.9 by commit 1f481aafff. TuxCare onboarded version 5.6.10, which already contained the upstream fix. The vulnerable code pattern is not present in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout automatically saves an empty security context and removes stored authentication. The persistence filter saves the cleared context in its finally block (web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:112). The repository removes the session attribute when an authenticated request ends with an empty context (web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:328).",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout automatically saves an empty security context and removes stored authentication. The persistence filter saves the cleared context in its finally block (web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:112). The repository removes the session attribute when an authenticated request ends with an empty context (web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:328)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.10 is not affected by CVE-2024-38810. The vulnerability specifically affects the @AuthorizeReturnObject annotation and MethodSecurityAdvisorRegistrar class introduced in Spring Security 6.3.0. Neither the annotation nor the vulnerable code exists in version 5.6.10, which uses a completely different authorization framework (MethodSecurityMetadataSourceAdvisorRegistrar). This ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.10 is not affected by CVE-2024-38810. The vulnerability specifically affects the @AuthorizeReturnObject annotation and MethodSecurityAdvisorRegistrar class introduced in Spring Security 6.3.0. Neither the annotation nor the vulnerable code exists in version 5.6.10, which uses a completely different authorization framework (MethodSecurityMetadataSourceAdvisorRegistrar). This ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-08T23:44:50.374630+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core, and is fixed in 5.6.10-tuxcare.12.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "action_statement": "Vulnerability CVE-2025-22223 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core, and is fixed in 5.6.10-tuxcare.12."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 is fixed in version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.6.10 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.6.10 does not contain that scanner, so it is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "action_statement": "Vulnerability CVE-2025-41248 affects version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.10 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature do not exist in this version. The OTT feature was introduced in Spring Security 6.4.0, well after the 5.6.x release line. Exhaustive searches confirmed no OneTimeToken-related code exists in the target repository. This is a Rule ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.10 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature do not exist in this version. The OTT feature was introduced in Spring Security 6.4.0, well after the 5.6.x release line. Exhaustive searches confirmed no OneTimeToken-related code exists in the target repository. This is a Rule ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:34.876883+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.6.10-tuxcare.11 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.10 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers utility class with matchInternal() and matchExternal() methods) does not exist in this version. This functionality was introduced in Spring Security 7.1, confirmed by the @since 7.1 annotation in the upstream repository. Version 5.6.10 only has IpAddressMatcher for specific IP/subnet matching...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.10 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers utility class with matchInternal() and matchExternal() methods) does not exist in this version. This functionality was introduced in Spring Security 7.1, confirmed by the @since 7.1 annotation in the upstream repository. Version 5.6.10 only has IpAddressMatcher for specific IP/subnet matching..."
    }
  ]
}