{
  "@id": "urn:uuid:c4ed6d50-03f3-4ffc-872b-bba997d17ed3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 43,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T17:58:00.136696+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T21:06:03.266818+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 describes a path parameter bypass vulnerability in Spring Security 2.x-3.x where attackers could add semicolon-delimited path parameters (e.g., /admin;x=y) to URLs to bypass security constraints. The fix (SEC-1584) introduced HttpFirewall and RequestWrapper that strip path parameters before security pattern matching. This fix was committed by Luke Taylor in October 2010 (commit 7d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 describes a path parameter bypass vulnerability in Spring Security 2.x-3.x where attackers could add semicolon-delimited path parameters (e.g., /admin;x=y) to URLs to bypass security constraints. The fix (SEC-1584) introduced HttpFirewall and RequestWrapper that strip path parameters before security pattern matching. This fix was committed by Luke Taylor in October 2010 (commit 7d..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:37:00.087847+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 5.6.9. The vulnerability was fixed by upstream Spring Security developers in commits 5fce0a58bd (SEC-1750) and 9a9aafaeec (SEC-1967), both of which were included in the upstream release before TuxCare onboarded version 5.6.9. The fixes isolate RunAs authentication in a thread-specific SecurityContext and ensure proper cleanup via finally blocks, p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 5.6.9. The vulnerability was fixed by upstream Spring Security developers in commits 5fce0a58bd (SEC-1750) and 9a9aafaeec (SEC-1967), both of which were included in the upstream release before TuxCare onboarded version 5.6.9. The fixes isolate RunAs authentication in a thread-specific SecurityContext and ensure proper cleanup via finally blocks, p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:14:45.025142+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.6.9. The vulnerability affected versions before 2.0.7 and 3.0.x before 3.0.6. The target version (5.6.9) contains the upstream vendor fix from 2011 that validates and rejects redirect locations containing CR/LF characters. The fix was authored by Luke Taylor (luke.taylor@springsource.com) and was already prese...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.6.9. The vulnerability affected versions before 2.0.7 and 3.0.x before 3.0.6. The target version (5.6.9) contains the upstream vendor fix from 2011 that validates and rejects redirect locations containing CR/LF characters. The fix was authored by Luke Taylor (luke.taylor@springsource.com) and was already prese..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T22:53:03.613650+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 is NOT present in Spring Security 5.6.9. The vulnerability involved serializing complete SecurityContext objects during RMI remote invocations, allowing attackers to inject malicious object graphs (Proxy/InvocationHandler, AOP interfaces) that execute arbitrary code during deserialization. The upstream fix (SEC-1741, commit b48fc53fa2) replaced this with String-only transmission o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is NOT present in Spring Security 5.6.9. The vulnerability involved serializing complete SecurityContext objects during RMI remote invocations, allowing attackers to inject malicious object graphs (Proxy/InvocationHandler, AOP interfaces) that execute arbitrary code during deserialization. The upstream fix (SEC-1741, commit b48fc53fa2) replaced this with String-only transmission o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T21:21:56.857726+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.6.9. The SEC-2056 fix (commit c076f0f2e1 by Rob Winch) was introduced upstream in versions 2.0.8, 3.0.8, and 3.1.3 (released September 2012) and has been carried forward through all subsequent versions. The target version 5.6.9 contains the complete mitigation: the DaoAuthenticationProvider performs password validatio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.6.9. The SEC-2056 fix (commit c076f0f2e1 by Rob Winch) was introduced upstream in versions 2.0.8, 3.0.8, and 3.1.3 (released September 2012) and has been carried forward through all subsequent versions. The target version 5.6.9 contains the complete mitigation: the DaoAuthenticationProvider performs password validatio..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T17:45:45.570904+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 5.6.9 repository is not affected by CVE-2014-3527. The vulnerability allowed malicious CAS services to spoof service identity by manipulating HTTP Host headers during proxy ticket authentication. The fix (commit 934937d9c1) was authored by Rob Winch from Pivotal/Spring team in July 2014 and was already present in the upstream 5.6.9 release that TuxCare onboarded. The vulnerable code pattern has been completely replaced with secure code that uses configured ServiceProperties URLs instead of untrusted HTTP request headers.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target Spring Security 5.6.9 repository is not affected by CVE-2014-3527. The vulnerability allowed malicious CAS services to spoof service identity by manipulating HTTP Host headers during proxy ticket authentication. The fix (commit 934937d9c1) was authored by Rob Winch from Pivotal/Spring team in July 2014 and was already present in the upstream 5.6.9 release that TuxCare onboarded. The vulnerable code pattern has been completely replaced with secure code that uses configured ServiceProperties URLs instead of untrusted HTTP request headers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:37:57.932432+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2016-5007 is not present in Spring Security 5.6.9. The vulnerability concerned differences in URL pattern matching between Spring Security and Spring MVC that could allow authorization bypass. Both upstream fixes were shipped in Spring Security 5.6.0 (released before TuxCare onboarded version 5.6.9): (1) MvcRequestMatcher class added to align Spring Security's pattern matching with Spring MVC's rules, and (2) DefaultHttpFirewall enhanced to block URL-encoded slashes (%2f/%2F) that could bypass security rules. Both fixes are present in the target at HEAD, authored by upstream developer Rob Winch (rwinch@gopivotal.com), and were included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Security 5.6.9. The vulnerability concerned differences in URL pattern matching between Spring Security and Spring MVC that could allow authorization bypass. Both upstream fixes were shipped in Spring Security 5.6.0 (released before TuxCare onboarded version 5.6.9): (1) MvcRequestMatcher class added to align Spring Security's pattern matching with Spring MVC's rules, and (2) DefaultHttpFirewall enhanced to block URL-encoded slashes (%2f/%2F) that could bypass security rules. Both fixes are present in the target at HEAD, authored by upstream developer Rob Winch (rwinch@gopivotal.com), and were included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:14:20.152420+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2016-9879 is NOT present in Spring Security 5.6.9. The vulnerability allowed attackers to bypass security constraints by adding URL-encoded slashes (%2f/%2F) to request URIs, exploiting inconsistent servlet container handling of path parameters. The fix, which rejects requests containing encoded slashes via DefaultHttpFirewall.containsInvalidUrlEncodedSlash(), was authored by Rob Winch (Pivotal) in December 2016 and released in Spring Security versions 3.2.10, 4.1.4, and 4.2.1. This fix shipped with the upstream Spring Security 5.6.9 release that TuxCare onboarded in September 2026. The vulnerable code pattern (processing URIs with encoded slashes without rejection) is not present in the target. The defense is active by default (allowUrlEncodedSlash=false) and is not disabled in any configuration files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "CVE-2016-9879 is NOT present in Spring Security 5.6.9. The vulnerability allowed attackers to bypass security constraints by adding URL-encoded slashes (%2f/%2F) to request URIs, exploiting inconsistent servlet container handling of path parameters. The fix, which rejects requests containing encoded slashes via DefaultHttpFirewall.containsInvalidUrlEncodedSlash(), was authored by Rob Winch (Pivotal) in December 2016 and released in Spring Security versions 3.2.10, 4.1.4, and 4.2.1. This fix shipped with the upstream Spring Security 5.6.9 release that TuxCare onboarded in September 2026. The vulnerable code pattern (processing URIs with encoded slashes without rejection) is not present in the target. The defense is active by default (allowUrlEncodedSlash=false) and is not disabled in any configuration files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2017-4995 is NOT present in Spring Security 5.6.9. The vulnerability concerned unrestricted class instantiation during Jackson deserialization when using Spring Security's SecurityJackson2Modules.enableDefaultTyping(). The target repository contains the upstream fix (commit 5dee8534cd) which replaced permissive default typing with an AllowlistTypeIdResolver that validates class names before instantiation. This fix was already present in the upstream Spring Security 5.6.9 release before TuxCare onboarded it (first TuxCare commit: 225cbba428). The vulnerable pattern (unrestricted ObjectMapper.enableDefaultTyping call without whitelist validation) is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "CVE-2017-4995 is NOT present in Spring Security 5.6.9. The vulnerability concerned unrestricted class instantiation during Jackson deserialization when using Spring Security's SecurityJackson2Modules.enableDefaultTyping(). The target repository contains the upstream fix (commit 5dee8534cd) which replaced permissive default typing with an AllowlistTypeIdResolver that validates class names before instantiation. This fix was already present in the upstream Spring Security 5.6.9 release before TuxCare onboarded it (first TuxCare commit: 225cbba428). The vulnerable pattern (unrestricted ObjectMapper.enableDefaultTyping call without whitelist validation) is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:46:51.408476+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Security 5.6.9. The vulnerability involved bypassing security constraints using semicolon path parameters due to inconsistent servlet container handling of getPathInfo(). The fix (StrictHttpFirewall rejecting URLs with semicolons) was introduced in upstream commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 and shipped in Spring Security 5.0.1.RELEASE (Octobe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Security 5.6.9. The vulnerability involved bypassing security constraints using semicolon path parameters due to inconsistent servlet container handling of getPathInfo(). The fix (StrictHttpFirewall rejecting URLs with semicolons) was introduced in upstream commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 and shipped in Spring Security 5.0.1.RELEASE (Octobe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 5.6.9 is NOT affected by CVE-2018-15801. The vulnerability affected versions 5.1.x prior to 5.1.2 and involved JWT issuer validation using Java's URL.equals() method, which has problematic equality semantics (DNS resolution, normalization) that could allow different issuer URLs to be treated as equal. The fix (commit 19649db9ce) changed issuer validation from URL object comparison to String comparison. This fix was already present in the upstream Spring Security 5.6.9 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the onboarding commit 225cbba428. The target code uses String-based issuer comparison throughout the validation chain, with no URL.equals() calls present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "Spring Security 5.6.9 is NOT affected by CVE-2018-15801. The vulnerability affected versions 5.1.x prior to 5.1.2 and involved JWT issuer validation using Java's URL.equals() method, which has problematic equality semantics (DNS resolution, normalization) that could allow different issuer URLs to be treated as equal. The fix (commit 19649db9ce) changed issuer validation from URL object comparison to String comparison. This fix was already present in the upstream Spring Security 5.6.9 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the onboarding commit 225cbba428. The target code uses String-based issuer comparison throughout the validation chain, with no URL.equals() calls present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 5.6.9 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security 5.x in October 2017 as part of deprecating the legacy authentication.encoding package. This removal occurred before version 5.6.9 existed and before the CVE was discovered in June 2019. The CVE only affects older versions (4.2.x and earlier) that still contained the deprecated class. The target version never had this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.6.9 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security 5.x in October 2017 as part of deprecating the legacy authentication.encoding package. This removal occurred before version 5.6.9 existed and before the CVE was discovered in June 2019. The CVE only affects older versions (4.2.x and earlier) that still contained the deprecated class. The target version never had this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T23:56:59.714304+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 is NOT present in Spring Security 5.6.9. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used with custom seeds - the custom seed would completely replace the SecureRandom's internal state instead of mixing with system entropy, making the output predictable. The fix (calling nextBytes() before setSeed() to initialize with system entropy firs...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 is NOT present in Spring Security 5.6.9. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used with custom seeds - the custom seed would completely replace the SecureRandom's internal state instead of mixing with system entropy, making the output predictable. The fix (calling nextBytes() before setSeed() to initialize with system entropy firs..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:40:00.106473+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.6.9 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.6.9 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T22:13:10.282848+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 affects Spring Security versions prior to 5.3.2 (and other specific versions). The target is version 5.6.9, which is after the fixed version. The vendor's fix was to deprecate the insecure `queryableText()` method with a warning annotation. This deprecation was already present in upstream Spring Security 5.6.9 when TuxCare onboarded it (commit db155b3094 by eleftheria.kousathana@g...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects Spring Security versions prior to 5.3.2 (and other specific versions). The target is version 5.6.9, which is after the fixed version. The vendor's fix was to deprecate the insecure `queryableText()` method with a warning annotation. This deprecation was already present in upstream Spring Security 5.6.9 when TuxCare onboarded it (commit db155b3094 by eleftheria.kousathana@g..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2021-22119 DoS vulnerability via unlimited OAuth2 authorization request accumulation is NOT present in target Spring Security 5.6.9. The upstream vendor (Spring Security project) applied the fix in version 5.5.1 (commit 35f5ebdbcf, 2021-04-22) before TuxCare onboarded version 5.6.9 (2026-09-14). The fix limits authorization requests to one per session by default via the allowMultipleAuthorizationRequests flag, preventing resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 DoS vulnerability via unlimited OAuth2 authorization request accumulation is NOT present in target Spring Security 5.6.9. The upstream vendor (Spring Security project) applied the fix in version 5.5.1 (commit 35f5ebdbcf, 2021-04-22) before TuxCare onboarded version 5.6.9 (2026-09-14). The fix limits authorization requests to one per session by default via the allowMultipleAuthorizationRequests flag, preventing resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:14:36.349317+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 affects Spring Security versions 5.6.x prior to 5.6.4. The target is version 5.6.9, which already contains the upstream fix. The vulnerability (integer overflow causing zero BCrypt rounds when log_rounds=31) is not present. The fix was authored by Josh Cummings and shipped in Spring Security 5.6.9, which TuxCare onboarded on 2026-09-14. The vulnerable pattern (int rounds = 1 << l...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 affects Spring Security versions 5.6.x prior to 5.6.4. The target is version 5.6.9, which already contains the upstream fix. The vulnerability (integer overflow causing zero BCrypt rounds when log_rounds=31) is not present. The fix was authored by Josh Cummings and shipped in Spring Security 5.6.9, which TuxCare onboarded on 2026-09-14. The vulnerable pattern (int rounds = 1 << l..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:20:19.402749+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2022-22978 affects RegexRequestMatcher in Spring Security versions 5.5.6, 5.5.7, and older, where missing Pattern.DOTALL flag allows authorization bypass via paths containing newline/carriage return characters. The vulnerability pattern is NOT present in target version 5.6.9. The fix (adding Pattern.DOTALL flag) was authored by Rob Winch (upstream) in commit 70863952ae and shipped in the upstream Spring Security 5.6.9 release before TuxCare onboarded it. No TuxCare backport exists for 5.6.9 (backports only exist for older versions 3.2.8, 4.2.x, 5.1.x). Verdict: not_affected (upstream fix already in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 affects RegexRequestMatcher in Spring Security versions 5.5.6, 5.5.7, and older, where missing Pattern.DOTALL flag allows authorization bypass via paths containing newline/carriage return characters. The vulnerability pattern is NOT present in target version 5.6.9. The fix (adding Pattern.DOTALL flag) was authored by Rob Winch (upstream) in commit 70863952ae and shipped in the upstream Spring Security 5.6.9 release before TuxCare onboarded it. No TuxCare backport exists for 5.6.9 (backports only exist for older versions 3.2.8, 4.2.x, 5.1.x). Verdict: not_affected (upstream fix already in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 5.6.9 is NOT vulnerable to CVE-2022-31692. The upstream fix (commit 1f481aafff) was already present in the Spring Security 5.6.9 release when TuxCare onboarded it. The AuthorizationFilter class correctly extends GenericFilterBean with explicit dispatcher type handling, preventing the authorization bypass vulnerability that existed in earlier versions using OncePerRequestFilter.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "The target Spring Security 5.6.9 is NOT vulnerable to CVE-2022-31692. The upstream fix (commit 1f481aafff) was already present in the Spring Security 5.6.9 release when TuxCare onboarded it. The AuthorizationFilter class correctly extends GenericFilterBean with explicit dispatcher type handling, preventing the authorization bypass vulnerability that existed in earlier versions using OncePerRequestFilter.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T17:58:00.136696+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 5.6.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 5.6.9-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:52:51.215173+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.9 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3 and does not exist in version 5.6.9. Exhaustive searches of the codebase confirm the annotation, its interceptor (AuthorizeReturnObjectMethodInterceptor), and the entire authorization-on-return-object mechanism are absent. The tar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.9 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3 and does not exist in version 5.6.9. Exhaustive searches of the codebase confirm the annotation, its interceptor (AuthorizeReturnObjectMethodInterceptor), and the entire authorization-on-return-object mechanism are absent. The tar..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:43:00.151252+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:11.003578+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:43:00.151252+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Version 5.6.9 is not affected by CVE-2025-22234. This CVE describes a timing attack vulnerability that was introduced by the fix for CVE-2025-22228. The CVE-2025-22228 fix added a 72-byte password length check that was enforced during both encoding and verification, creating a timing side-channel. Version 5.6.9 never received the CVE-2025-22228 fix, so the vulnerable pattern (the unconditional ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 Version 5.6.9 is not affected by CVE-2025-22234. This CVE describes a timing attack vulnerability that was introduced by the fix for CVE-2025-22228. The CVE-2025-22228 fix added a 72-byte password length check that was enforced during both encoding and verification, creating a timing side-channel. Version 5.6.9 never received the CVE-2025-22228 fix, so the vulnerable pattern (the unconditional ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:47:42.736684+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.6.9 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.6.9 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T11:36:43.630807+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 5.6.9 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 5.6.9 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:43:00.151252+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T06:03:59.210364+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.9 is not affected by CVE-2026-22751. The One-Time Token authentication feature, including the vulnerable JdbcOneTimeTokenService class, does not exist in this version. The feature was introduced in Spring Security 6.x and is not present in the 5.6.x release line. Exhaustive searches for OneTimeToken-related code, JdbcOneTimeTokenService, and the authentication/ott package pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.9 is not affected by CVE-2026-22751. The One-Time Token authentication feature, including the vulnerable JdbcOneTimeTokenService class, does not exist in this version. The feature was introduced in Spring Security 6.x and is not present in the 5.6.x release line. Exhaustive searches for OneTimeToken-related code, JdbcOneTimeTokenService, and the authentication/ott package pa..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T18:45:12.712241+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.9 is not affected by CVE-2026-59277. The vulnerable component `InetAddressMatchers` class with its `matchInternal()` and `matchExternal()` builders does not exist in this version. This utility class was introduced in a later version of Spring Security (likely 6.x or later), while the target is version 5.6.9. Exhaustive searches confirmed no equivalent IP address internal/ext...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.9 is not affected by CVE-2026-59277. The vulnerable component `InetAddressMatchers` class with its `matchInternal()` and `matchExternal()` builders does not exist in this version. This utility class was introduced in a later version of Spring Security (likely 6.x or later), while the target is version 5.6.9. Exhaustive searches confirmed no equivalent IP address internal/ext..."
    }
  ]
}