{
  "@id": "urn:uuid:62b90a8d-61d7-48c9-9bb8-f1e298338ca6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 46,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:38:00.054920+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-core 5.7.11.tuxcare. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-core 5.7.11.tuxcare. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T20:48:22.600705+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 is NOT present in Spring Security 5.7.11. The vulnerability allowed bypassing security constraints via path parameters (semicolon-delimited parameters in URLs like /admin.html;x=user.html). The upstream fix (SEC-1584, commit 7d97adc687) was already present in the Spring Security 5.7.11 release that TuxCare onboarded. The fix introduces HttpFirewall infrastructure with two protecti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 is NOT present in Spring Security 5.7.11. The vulnerability allowed bypassing security constraints via path parameters (semicolon-delimited parameters in URLs like /admin.html;x=user.html). The upstream fix (SEC-1584, commit 7d97adc687) was already present in the Spring Security 5.7.11 release that TuxCare onboarded. The fix introduces HttpFirewall infrastructure with two protecti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T19:21:00.085443+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 5.7.11-tuxcare.11. The vulnerability (race condition in RunAsManager storing Authentication in shared security context) was fixed by upstream Spring Security in 2011-2012 via commits SEC-1750 (887e3361d2) and SEC-1967 (9a9aafaeec). These fixes were already in the upstream release when TuxCare onboarded version 5.7.11 in March 2026. The target code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 5.7.11-tuxcare.11. The vulnerability (race condition in RunAsManager storing Authentication in shared security context) was fixed by upstream Spring Security in 2011-2012 via commits SEC-1750 (887e3361d2) and SEC-1967 (9a9aafaeec). These fixes were already in the upstream release when TuxCare onboarded version 5.7.11 in March 2026. The target code..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T22:56:39.573169+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target is Spring Security 5.7.11-tuxcare.11, which already contains both upstream fixes from 2011: (1) FirewalledResponse validates redirect locations to reject CR/LF characters, preventing CRLF injection; (2) AbstractAuthenticationTargetUrlRequestHandler defaults targetUrlParameter to null, disabling parameter-based...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target is Spring Security 5.7.11-tuxcare.11, which already contains both upstream fixes from 2011: (1) FirewalledResponse validates redirect locations to reject CR/LF characters, preventing CRLF injection; (2) AbstractAuthenticationTargetUrlRequestHandler defaults targetUrlParameter to null, disabling parameter-based..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T22:36:28.853898+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.11 is NOT affected by CVE-2011-2894. The vulnerable deserialization pattern (serializing entire SecurityContext object from RMI client to server) is not present in the target code. The upstream fix was applied by Luke Taylor on 2011-08-12 (commit b48fc53fa2) and shipped in the upstream 5.7.11 release before TuxCare onboarded it. The current code only transmits principal/cred...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.11 is NOT affected by CVE-2011-2894. The vulnerable deserialization pattern (serializing entire SecurityContext object from RMI client to server) is not present in the target code. The upstream fix was applied by Luke Taylor on 2011-08-12 (commit b48fc53fa2) and shipped in the upstream 5.7.11 release before TuxCare onboarded it. The current code only transmits principal/cred..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T21:07:46.273258+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 (SEC-2056) is NOT present in the target. The timing attack vulnerability was fixed in upstream Spring Security commit c076f0f2e1 by Rob Winch (VMware) on 2012-09-21. This fix shipped in the upstream release 5.7.11 before TuxCare began maintenance. The target code contains the complete defense: prepareTimingAttackProtection() and mitigateAgainstTimingAttack() methods ensure passwor...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (SEC-2056) is NOT present in the target. The timing attack vulnerability was fixed in upstream Spring Security commit c076f0f2e1 by Rob Winch (VMware) on 2012-09-21. This fix shipped in the upstream release 5.7.11 before TuxCare began maintenance. The target code contains the complete defense: prepareTimingAttackProtection() and mitigateAgainstTimingAttack() methods ensure passwor..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T16:57:53.340226+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. CVE-2014-3527 is not present in Spring Security 5.7.11. The vulnerability was fixed by upstream Spring Security in commit 934937d9c1 (SEC-2688), which was included in version 4.0.0.M2 and all subsequent releases. The target version contains the complete fix: the service URL for CAS proxy ticket authentication is built from the pre-configured ServiceProperties.service URL rather than from untrusted HttpServletRequest headers (Host, scheme, port), preventing attackers from bypassing inter-service access control restrictions.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 is not present in Spring Security 5.7.11. The vulnerability was fixed by upstream Spring Security in commit 934937d9c1 (SEC-2688), which was included in version 4.0.0.M2 and all subsequent releases. The target version contains the complete fix: the service URL for CAS proxy ticket authentication is built from the pre-configured ServiceProperties.service URL rather than from untrusted HttpServletRequest headers (Host, scheme, port), preventing attackers from bypassing inter-service access control restrictions."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. Spring Security 5.7.11 is NOT affected by CVE-2016-5007. Both defenses from the vendor patches are present: (1) MvcRequestMatcher aligns Spring Security authorization pattern matching with Spring MVC controller routing, and (2) DefaultHttpFirewall blocks URL-encoded slashes that could bypass security rules. These fixes were authored by upstream maintainer Rob Winch (rwinch@gopivotal.com) in commits e4c13e3c0e (July 2016, MvcRequestMatcher) and 666e356ebc (December 2016, encoded slash blocking), both ancestors of HEAD and predating the first TuxCare commit a57e508bfb (\"Initial setup\"). The vulnerability was already fixed in the upstream Spring Security release that TuxCare onboarded, making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 5.7.11 is NOT affected by CVE-2016-5007. Both defenses from the vendor patches are present: (1) MvcRequestMatcher aligns Spring Security authorization pattern matching with Spring MVC controller routing, and (2) DefaultHttpFirewall blocks URL-encoded slashes that could bypass security rules. These fixes were authored by upstream maintainer Rob Winch (rwinch@gopivotal.com) in commits e4c13e3c0e (July 2016, MvcRequestMatcher) and 666e356ebc (December 2016, encoded slash blocking), both ancestors of HEAD and predating the first TuxCare commit a57e508bfb (\"Initial setup\"). The vulnerability was already fixed in the upstream Spring Security release that TuxCare onboarded, making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:58.922832+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. Spring Security 5.7.11-tuxcare.11 is NOT affected by CVE-2016-9879. The vulnerability (URL-encoded slash bypass) was fixed in upstream Spring Security 4.2.1.RELEASE (December 2016) by Rob Winch from Pivotal. The fix - which adds detection and rejection of %2f/%2F in request URIs to prevent security constraint bypass - was already present in the upstream release that TuxCare onboarded. The target inherits this protection from upstream commit 666e356ebc4, which predates all TuxCare modifications to this codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Spring Security 5.7.11-tuxcare.11 is NOT affected by CVE-2016-9879. The vulnerability (URL-encoded slash bypass) was fixed in upstream Spring Security 4.2.1.RELEASE (December 2016) by Rob Winch from Pivotal. The fix - which adds detection and rejection of %2f/%2F in request URIs to prevent security constraint bypass - was already present in the upstream release that TuxCare onboarded. The target inherits this protection from upstream commit 666e356ebc4, which predates all TuxCare modifications to this codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. Spring Security 5.7.11 is not affected by CVE-2017-4995. The upstream vendor (Spring Security project) fixed the Jackson deserialization vulnerability in commit 5dee8534cd by replacing direct default typing with whitelist-based validation (AllowlistTypeIdResolver). This fix was included in the upstream release before TuxCare onboarded version 5.7.11. The vulnerable pattern (unrestricted class deserialization) is absent; the defense code (three-tier validation: whitelist \u2192 mixin \u2192 Jackson annotations) is present at lines 201-286 of SecurityJackson2Modules.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 5.7.11 is not affected by CVE-2017-4995. The upstream vendor (Spring Security project) fixed the Jackson deserialization vulnerability in commit 5dee8534cd by replacing direct default typing with whitelist-based validation (AllowlistTypeIdResolver). This fix was included in the upstream release before TuxCare onboarded version 5.7.11. The vulnerable pattern (unrestricted class deserialization) is absent; the defense code (three-tier validation: whitelist \u2192 mixin \u2192 Jackson annotations) is present at lines 201-286 of SecurityJackson2Modules.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T16:42:38.207193+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.11-tuxcare.11 is NOT affected by CVE-2018-1199. The vulnerability allowed attackers to bypass security constraints using URL path parameters (semicolons) and special encodings. The upstream fix (StrictHttpFirewall) was already present in the upstream 5.7.11 release that TuxCare onboarded, eliminating the vulnerable pattern before TuxCare's first commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.11-tuxcare.11 is NOT affected by CVE-2018-1199. The vulnerability allowed attackers to bypass security constraints using URL path parameters (semicolons) and special encodings. The upstream fix (StrictHttpFirewall) was already present in the upstream 5.7.11 release that TuxCare onboarded, eliminating the vulnerable pattern before TuxCare's first commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. The target Spring Security 5.7.11-tuxcare.11 is NOT AFFECTED by CVE-2018-15801. The vulnerability (JWT issuer validation bypass via URL.equals() DNS resolution) was fixed in upstream commit 19649db9ce by Josh Cummings, which was already present in the upstream release that TuxCare onboarded. The target uses string-based comparison (issuer.equals(claimValue.toString())) instead of the vulnerable URL object comparison, and the MappedJwtClaimSetConverter returns issuer claims as Strings (via .toExternalForm()) rather than URL objects. This is an upstream fix that shipped before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "The target Spring Security 5.7.11-tuxcare.11 is NOT AFFECTED by CVE-2018-15801. The vulnerability (JWT issuer validation bypass via URL.equals() DNS resolution) was fixed in upstream commit 19649db9ce by Josh Cummings, which was already present in the upstream release that TuxCare onboarded. The target uses string-based comparison (issuer.equals(claimValue.toString())) instead of the vulnerable URL object comparison, and the MappedJwtClaimSetConverter returns issuer claims as Strings (via .toExternalForm()) rather than URL objects. This is an upstream fix that shipped before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x and older versions. The vulnerability allows authentication bypass when a user has a null encoded password by submitting the string \"null\" as the password. Target version 5.7.11-tuxcare.11 is NOT affected because PlaintextPasswordEncoder was removed entirely from Spring Security 5.0 by upstream (commit 12dbf2e961, October 2017), almost 2 years before the CVE was discovered (June 2019). The vulnerable class does not exist in any 5.x version. TuxCare backported the fix to older versions (3.2.8, 1.0.7, 4.2.12) that still had the code, but 5.x versions never required the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x and older versions. The vulnerability allows authentication bypass when a user has a null encoded password by submitting the string \"null\" as the password. Target version 5.7.11-tuxcare.11 is NOT affected because PlaintextPasswordEncoder was removed entirely from Spring Security 5.0 by upstream (commit 12dbf2e961, October 2017), almost 2 years before the CVE was discovered (June 2019). The vulnerable class does not exist in any 5.x version. TuxCare backported the fix to older versions (3.2.8, 1.0.7, 4.2.12) that still had the code, but 5.x versions never required the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-02T23:54:12.578535+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5. The target repository (Spring Security 5.7.11-tuxcare.11) is NOT vulnerable. The upstream fix (commit 9c1eac79e2 by Josh Cummings, March 2019) was already present in the upstream Spring Security 5.7.11 release before TuxCare onboarding. The vulnerable pattern (calling setSeed()...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5. The target repository (Spring Security 5.7.11-tuxcare.11) is NOT vulnerable. The upstream fix (commit 9c1eac79e2 by Josh Cummings, March 2019) was already present in the upstream Spring Security 5.7.11 release before TuxCare onboarding. The vulnerable pattern (calling setSeed()..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-06T18:38:00.054920+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.7.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.7.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. Version 5.7.11 is not vulnerable to CVE-2020-5408. No backport is needed. The fix was included in Spring Security 5.3.2, and version 5.7.11 already incorporates it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "Version 5.7.11 is not vulnerable to CVE-2020-5408. No backport is needed. The fix was included in Spring Security 5.3.2, and version 5.7.11 already incorporates it."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. Spring Security 5.7.11-tuxcare.11 is NOT affected by CVE-2021-22119. The vulnerability (DoS via unbounded OAuth2 authorization request storage) was fixed in upstream Spring Security 5.5.1 (April 2021). Version 5.7.11 is significantly newer and contains the upstream fix, which limits storage to ONE authorization request per session by default through the allowMultipleAuthorizationRequests flag (defaults to false). The fix commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71 by Craig Andrews was already present in the upstream 5.7.11 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "Spring Security 5.7.11-tuxcare.11 is NOT affected by CVE-2021-22119. The vulnerability (DoS via unbounded OAuth2 authorization request storage) was fixed in upstream Spring Security 5.5.1 (April 2021). Version 5.7.11 is significantly newer and contains the upstream fix, which limits storage to ONE authorization request per session by default through the allowMultipleAuthorizationRequests flag (defaults to false). The fix commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71 by Craig Andrews was already present in the upstream 5.7.11 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T05:11:00.089232+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.11-tuxcare.11 is NOT AFFECTED by CVE-2022-22976. The integer overflow vulnerability in BCrypt's maximum work factor (31) handling was fixed in upstream commit a40f73521c (June 2021, \"Improve Upgrading\" by Josh Cummings). This fix was already present in the upstream Spring Security 5.7.x release that TuxCare onboarded. The vulnerable pattern (int overflow from `rounds = 1 << ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.11-tuxcare.11 is NOT AFFECTED by CVE-2022-22976. The integer overflow vulnerability in BCrypt's maximum work factor (31) handling was fixed in upstream commit a40f73521c (June 2021, \"Improve Upgrading\" by Josh Cummings). This fix was already present in the upstream Spring Security 5.7.x release that TuxCare onboarded. The vulnerable pattern (int overflow from `rounds = 1 << ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. Spring Security 5.7.11 is not affected by CVE-2022-22978. The vulnerability allowed authorization bypass via newline characters in request paths exploiting the regex `.` metacharacter's inability to match newlines. The fix (adding Pattern.DOTALL flag to RegexRequestMatcher) was included in the upstream Spring Security 5.7.11 release (September 2023), which shipped well after the fix commit (May 2022). The target contains the corrected code where DEFAULT = Pattern.DOTALL, ensuring regex patterns like `/admin.*` correctly match paths containing newlines, preventing the bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "Spring Security 5.7.11 is not affected by CVE-2022-22978. The vulnerability allowed authorization bypass via newline characters in request paths exploiting the regex `.` metacharacter's inability to match newlines. The fix (adding Pattern.DOTALL flag to RegexRequestMatcher) was included in the upstream Spring Security 5.7.11 release (September 2023), which shipped well after the fix commit (May 2022). The target contains the corrected code where DEFAULT = Pattern.DOTALL, ensuring regex patterns like `/admin.*` correctly match paths containing newlines, preventing the bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. CVE-2022-31692 affects Spring Security 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9. The target is Spring Security 5.7.11-tuxcare.11, which already contains the upstream fix (commit 1f481aafff14f324ffe2b43a973d3d5f54ae92d4) that shipped with Spring Security 5.7.5. The vulnerable pattern (AuthorizationFilter extending OncePerRequestFilter without proper dispatcher type handling) is not present. The target code correctly extends GenericFilterBean with explicit dispatcher type controls (skipDispatch(), setShouldFilterAllDispatcherTypes()), preventing authorization bypass via FORWARD/INCLUDE dispatchers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 affects Spring Security 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9. The target is Spring Security 5.7.11-tuxcare.11, which already contains the upstream fix (commit 1f481aafff14f324ffe2b43a973d3d5f54ae92d4) that shipped with Spring Security 5.7.5. The vulnerable pattern (AuthorizationFilter extending OncePerRequestFilter without proper dispatcher type handling) is not present. The target code correctly extends GenericFilterBean with explicit dispatcher type controls (skipDispatch(), setShouldFilterAllDispatcherTypes()), preventing authorization bypass via FORWARD/INCLUDE dispatchers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-02T22:43:54.379537+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 affects Spring Security versions 5.7.x prior to 5.7.8. The target is Spring Security 5.7.11-tuxcare.11, which already contains the upstream fix from version 5.7.8. The fix (commit 2d52fb8e4bffca409b2c7bd18a01a8eb5cfd7451, dated 2023-03-14) was shipped in the upstream 5.7.11 release that TuxCare onboarded. The vulnerable pattern\u2014logout failing to clear serialized security contexts...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 affects Spring Security versions 5.7.x prior to 5.7.8. The target is Spring Security 5.7.11-tuxcare.11, which already contains the upstream fix from version 5.7.8. The fix (commit 2d52fb8e4bffca409b2c7bd18a01a8eb5cfd7451, dated 2023-03-14) was shipped in the upstream 5.7.11 release that TuxCare onboarded. The vulnerable pattern\u2014logout failing to clear serialized security contexts..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.7.11.tuxcare of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:02.879946+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.11-tuxcare.11 is NOT AFFECTED by CVE-2024-38810. The vulnerability relates to the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3.0 (March 2024). This target version (5.7.11) predates the feature by several major releases. The vulnerable code pattern\u2014the AuthorizeReturnObject annotation and its AuthorizeReturnObjectMethodInterceptor with the pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.11-tuxcare.11 is NOT AFFECTED by CVE-2024-38810. The vulnerability relates to the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3.0 (March 2024). This target version (5.7.11) predates the feature by several major releases. The vulnerable code pattern\u2014the AuthorizeReturnObject annotation and its AuthorizeReturnObjectMethodInterceptor with the pr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core, and is fixed in 5.7.11-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core, and is fixed in 5.7.11-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T02:11:01.060172+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.11 is NOT affected by CVE-2025-22223. The vulnerable class `UniqueSecurityAnnotationScanner` does not exist in this version - it was introduced in Spring Security 6.4.0 (August 2024). Version 5.7.11 uses a different annotation scanning mechanism based on Spring Framework's `AopUtils.getMostSpecificMethod()` and `AnnotationUtils.findAnnotation()`, which properly handles param...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.11 is NOT affected by CVE-2025-22223. The vulnerable class `UniqueSecurityAnnotationScanner` does not exist in this version - it was introduced in Spring Security 6.4.0 (August 2024). Version 5.7.11 uses a different annotation scanning mechanism based on Spring Framework's `AopUtils.getMostSpecificMethod()` and `AnnotationUtils.findAnnotation()`, which properly handles param..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core, and is fixed in 5.7.11-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core, and is fixed in 5.7.11-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T10:48:29.606694+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.11 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.11 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. According to GitHub Advisory CVE-2025-41248 is exclusive to versions between 6.4.0 and 6.4.9, hence 5.7.11 is not affected",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "According to GitHub Advisory CVE-2025-41248 is exclusive to versions between 6.4.0 and 6.4.9, hence 5.7.11 is not affected"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core, and is fixed in 5.7.11-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      },
      "action_statement": "Vulnerability CVE-2026-22746 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core, and is fixed in 5.7.11-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 5.7.11 because the vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken login feature do not exist in this version. The OneTimeToken feature was introduced in Spring Security 6.4.0 (October 2024), which is significantly after the 5.7.11 release. The target version predates the vulnerable code entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-22751 does not affect Spring Security 5.7.11 because the vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken login feature do not exist in this version. The OneTimeToken feature was introduced in Spring Security 6.4.0 (October 2024), which is significantly after the 5.7.11 release. The target version predates the vulnerable code entirely."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-15T18:55:01.094967+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core, and is fixed in 5.7.11-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.7.11.tuxcare of org.springframework.security:spring-security-core, and is fixed in 5.7.11-tuxcare.10."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.11.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.7.11.tuxcare of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security version 5.7.11-tuxcare.11 is NOT affected by CVE-2026-59277. The vulnerable InetAddressMatchers utility class with its matchInternal() and matchExternal() methods does not exist in this version. This functionality for classifying IP addresses as internal/external was introduced in a later version of Spring Security. Version 5.7.11 only contains IpAddressMatcher for matching spec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security version 5.7.11-tuxcare.11 is NOT affected by CVE-2026-59277. The vulnerable InetAddressMatchers utility class with its matchInternal() and matchExternal() methods does not exist in this version. This functionality for classifying IP addresses as internal/external was introduced in a later version of Spring Security. Version 5.7.11 only contains IpAddressMatcher for matching spec..."
    }
  ]
}