{
  "@id": "urn:uuid:4503029d-fc1d-436e-8f5d-b4a68d9724e8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T10:27:11.003578+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-core 5.7.14-tuxcare.6. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-core 5.7.14-tuxcare.6. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T20:54:01.505024+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 (path parameter security bypass) is NOT present in Spring Security 5.7.14. The vulnerability allowed attackers to bypass security constraints by adding path parameters (e.g., `/secured;x=y/admin.html`) to URLs. The fix (SEC-1584) was applied by upstream Spring Security in October 2010 for version 3.0.4, introducing HttpFirewall with RequestWrapper to strip path parameters before s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 (path parameter security bypass) is NOT present in Spring Security 5.7.14. The vulnerability allowed attackers to bypass security constraints by adding path parameters (e.g., `/secured;x=y/admin.html`) to URLs. The fix (SEC-1584) was applied by upstream Spring Security in October 2010 for version 3.0.4, introducing HttpFirewall with RequestWrapper to strip path parameters before s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T19:25:00.123960+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 describes a race condition in Spring Security's RunAsManager mechanism where multiple threads could share the same SecurityContext object, leading to privilege escalation. The target repository (Spring Security 5.7.14-tuxcare.10) is NOT AFFECTED because the upstream fixes (SEC-1750 and SEC-1967) were already present in the Spring Security 5.7.14 release that TuxCare onboarded. The...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 describes a race condition in Spring Security's RunAsManager mechanism where multiple threads could share the same SecurityContext object, leading to privilege escalation. The target repository (Spring Security 5.7.14-tuxcare.10) is NOT AFFECTED because the upstream fixes (SEC-1750 and SEC-1967) were already present in the Spring Security 5.7.14 release that TuxCare onboarded. The..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T23:02:53.904310+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 5.7.14-tuxcare.10) is not affected by CVE-2011-2732. The CRLF injection vulnerability in logout redirect handling was fixed in upstream Spring Security in 2011 (commit 824464516ceb by Luke Taylor) and is present in the 5.7.14 release that TuxCare onboarded. The FirewalledResponse class wraps all HTTP responses and validates redirect locations, rejecting an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 5.7.14-tuxcare.10) is not affected by CVE-2011-2732. The CRLF injection vulnerability in logout redirect handling was fixed in upstream Spring Security in 2011 (commit 824464516ceb by Luke Taylor) and is present in the 5.7.14 release that TuxCare onboarded. The FirewalledResponse class wraps all HTTP responses and validates redirect locations, rejecting an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T22:41:16.546891+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.7.14-tuxcare.10 is NOT AFFECTED by CVE-2011-2894. The deserialization vulnerability was fixed upstream by Luke Taylor in May 2011 (commit b48fc53fa2) and the fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The vulnerable pattern (serializing entire SecurityContext objects via RMI) has been replaced with a safe pattern (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.7.14-tuxcare.10 is NOT AFFECTED by CVE-2011-2894. The deserialization vulnerability was fixed upstream by Luke Taylor in May 2011 (commit b48fc53fa2) and the fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The vulnerable pattern (serializing entire SecurityContext objects via RMI) has been replaced with a safe pattern (..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T21:14:20.175704+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 describes a timing attack vulnerability in DaoAuthenticationProvider that allows username enumeration. The target Spring Security 5.7.14-tuxcare.10 contains the complete SEC-2056 fix including timing attack mitigation methods (prepareTimingAttackProtection, mitigateAgainstTimingAttack) that ensure password validation occurs even when a user is not found. The fix was authored by up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 describes a timing attack vulnerability in DaoAuthenticationProvider that allows username enumeration. The target Spring Security 5.7.14-tuxcare.10 contains the complete SEC-2056 fix including timing attack mitigation methods (prepareTimingAttackProtection, mitigateAgainstTimingAttack) that ensure password validation occurs even when a user is not found. The fix was authored by up..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T17:02:17.808637+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2014-3527 (SEC-2688) affects Spring Security CAS proxy ticket authentication via Host header injection. The vulnerability allowed attackers to manipulate the service URL used for ticket validation by controlling HTTP Host headers. The fix (commit 934937d9c1, July 2014) changed DefaultServiceAuthenticationDetails to build service URLs from trusted configuration (ServiceProperties) instead of untrusted HTTP request headers. This fix was authored by Rob Winch (upstream Spring Security maintainer) and shipped with upstream Spring Security 5.7.14 before TuxCare onboarded this version. The vulnerable code pattern (using request.getScheme()/getServerName()/getServerPort()) is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 (SEC-2688) affects Spring Security CAS proxy ticket authentication via Host header injection. The vulnerability allowed attackers to manipulate the service URL used for ticket validation by controlling HTTP Host headers. The fix (commit 934937d9c1, July 2014) changed DefaultServiceAuthenticationDetails to build service URLs from trusted configuration (ServiceProperties) instead of untrusted HTTP request headers. This fix was authored by Rob Winch (upstream Spring Security maintainer) and shipped with upstream Spring Security 5.7.14 before TuxCare onboarded this version. The vulnerable code pattern (using request.getScheme()/getServerName()/getServerPort()) is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2016-5007 describes authorization bypass via URL pattern matching discrepancies between Spring Security and Spring MVC. The target (Spring Security 5.7.14) contains both upstream fixes: (1) MvcRequestMatcher class using HandlerMappingIntrospector for pattern-matching alignment with Spring MVC, and (2) DefaultHttpFirewall blocking URL-encoded slashes (%2f/%2F) by default. Both fixes were authored by Rob Winch (rwinch@gopivotal.com) in 2016 and shipped in Spring Security 5.4.0+. The target version 5.7.14 inherited these fixes from the upstream release (commit 51ec4ce8 \"Initial setup spring-security 5.7.14\" by npinsker@cloudlinux.com). No TuxCare backport was needed - the vulnerability pattern is absent due to upstream vendor fixes already present in the 5.7.14 baseline.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 describes authorization bypass via URL pattern matching discrepancies between Spring Security and Spring MVC. The target (Spring Security 5.7.14) contains both upstream fixes: (1) MvcRequestMatcher class using HandlerMappingIntrospector for pattern-matching alignment with Spring MVC, and (2) DefaultHttpFirewall blocking URL-encoded slashes (%2f/%2F) by default. Both fixes were authored by Rob Winch (rwinch@gopivotal.com) in 2016 and shipped in Spring Security 5.4.0+. The target version 5.7.14 inherited these fixes from the upstream release (commit 51ec4ce8 \"Initial setup spring-security 5.7.14\" by npinsker@cloudlinux.com). No TuxCare backport was needed - the vulnerability pattern is absent due to upstream vendor fixes already present in the 5.7.14 baseline.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:05.431502+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. The target Spring Security 5.7.14 is not affected by CVE-2016-9879. The fix for this vulnerability (blocking URL-encoded slashes in request URIs to prevent security constraint bypass) was already present in the upstream Spring Security release when TuxCare onboarded version 5.7.14. The fix was originally implemented in commit 666e356ebc by Rob Winch (Spring Security maintainer) and released in Spring Security 4.2.1 in December 2016, well before version 5.7.14. The defense code is present in DefaultHttpFirewall.java and enabled by default, rejecting requests containing %2f or %2F in the request URI before security constraint matching occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target Spring Security 5.7.14 is not affected by CVE-2016-9879. The fix for this vulnerability (blocking URL-encoded slashes in request URIs to prevent security constraint bypass) was already present in the upstream Spring Security release when TuxCare onboarded version 5.7.14. The fix was originally implemented in commit 666e356ebc by Rob Winch (Spring Security maintainer) and released in Spring Security 4.2.1 in December 2016, well before version 5.7.14. The defense code is present in DefaultHttpFirewall.java and enabled by default, rejecting requests containing %2f or %2F in the request URI before security constraint matching occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. The target Spring Security 5.7.14 is NOT AFFECTED by CVE-2017-4995. The vulnerability involves unrestricted Jackson default typing that allows arbitrary code execution via deserialization gadgets. The fix (commit 5dee8534cd1b92952d10cc56335b5d5856f48f3b from June 2017) replaced unrestricted default typing with allowlist-based type resolution, and this fix was already present in the upstream Spring Security 5.7.14 release when TuxCare onboarded the repository in March 2026. The vulnerable code pattern (unrestricted enableDefaultTyping) has been replaced with createAllowlistedDefaultTyping() that blocks unknown deserialization gadgets through WhitelistTypeIdResolver/AllowlistTypeIdResolver.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "The target Spring Security 5.7.14 is NOT AFFECTED by CVE-2017-4995. The vulnerability involves unrestricted Jackson default typing that allows arbitrary code execution via deserialization gadgets. The fix (commit 5dee8534cd1b92952d10cc56335b5d5856f48f3b from June 2017) replaced unrestricted default typing with allowlist-based type resolution, and this fix was already present in the upstream Spring Security 5.7.14 release when TuxCare onboarded the repository in March 2026. The vulnerable code pattern (unrestricted enableDefaultTyping) has been replaced with createAllowlistedDefaultTyping() that blocks unknown deserialization gadgets through WhitelistTypeIdResolver/AllowlistTypeIdResolver.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:30.480251+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is NOT present in spring-security 5.7.14-tuxcare.10. The fix was already included in the upstream 5.7.14 release. The StrictHttpFirewall class, introduced in upstream commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 (Spring Security 5.0.1), is present and configured as the default HTTP firewall. It rejects requests containing semicolons (both literal ';' and URL-encoded '%3b'/'%3B'...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in spring-security 5.7.14-tuxcare.10. The fix was already included in the upstream 5.7.14 release. The StrictHttpFirewall class, introduced in upstream commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 (Spring Security 5.0.1), is present and configured as the default HTTP firewall. It rejects requests containing semicolons (both literal ';' and URL-encoded '%3b'/'%3B'..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.7.14 is not affected by CVE-2018-15801. The vulnerability involved JWT issuer validation using Java URL object comparison (URL.equals()), which can incorrectly treat different issuer URLs as equivalent due to DNS resolution side effects. The upstream vendor (Spring Security project) fixed this in late 2018 by replacing URL object comparison with string-based comparison. This fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded, as confirmed by git ancestry analysis showing fix commit 19649db9ce predates the first TuxCare commit by 4,239 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "Spring Security 5.7.14 is not affected by CVE-2018-15801. The vulnerability involved JWT issuer validation using Java URL object comparison (URL.equals()), which can incorrectly treat different issuer URLs as equivalent due to DNS resolution side effects. The upstream vendor (Spring Security project) fixed this in late 2018 by replacing URL object comparison with string-based comparison. This fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded, as confirmed by git ancestry analysis showing fix commit 19649db9ce predates the first TuxCare commit by 4,239 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.7.14 is not affected by CVE-2019-11272. The vulnerable component (PlaintextPasswordEncoder) was removed from Spring Security 5.0 in October 2017 (commit 12dbf2e9612c), well before the CVE was published in June 2019. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions. Version 5.7.14 is from the 5.x series which replaced the deprecated authentication.encoding package with the crypto.password package. The removal was part of the upstream release and was authored by Rob Winch (upstream), not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.7.14 is not affected by CVE-2019-11272. The vulnerable component (PlaintextPasswordEncoder) was removed from Spring Security 5.0 in October 2017 (commit 12dbf2e9612c), well before the CVE was published in June 2019. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions. Version 5.7.14 is from the 5.x series which replaced the deprecated authentication.encoding package with the crypto.password package. The removal was part of the upstream release and was authored by Rob Winch (upstream), not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T23:53:16.670486+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x < 4.2.12, 5.0.x < 5.0.12, and 5.1.x < 5.1.5. The target is Spring Security 5.7.14-tuxcare.10, which is significantly newer. The vulnerability involved SecureRandomFactoryBean calling setSeed() before nextBytes(), allowing application-provided seeds to completely replace (rather than supplement) the SecureRandom's internal entropy state. The f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x < 4.2.12, 5.0.x < 5.0.12, and 5.1.x < 5.1.5. The target is Spring Security 5.7.14-tuxcare.10, which is significantly newer. The vulnerability involved SecureRandomFactoryBean calling setSeed() before nextBytes(), allowing application-provided seeds to completely replace (rather than supplement) the SecureRandom's internal entropy state. The f..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-06T18:39:00.080138+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.7.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.7.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T22:03:47.730298+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 is NOT present in Spring Security 5.7.14. The vulnerability involves using a fixed null initialization vector with CBC mode in the queryableText() encryptor, enabling dictionary attacks. The vendor's fix (deprecation of queryableText() with security warning) was already included in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The vulnerable pattern (unwarned...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 is NOT present in Spring Security 5.7.14. The vulnerability involves using a fixed null initialization vector with CBC mode in the queryableText() encryptor, enabling dictionary attacks. The vendor's fix (deprecation of queryableText() with security warning) was already included in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The vulnerable pattern (unwarned..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.7.14 is not affected by CVE-2021-22119. The vulnerability allowed attackers to exhaust system resources by sending multiple OAuth2 authorization requests that accumulated unboundedly in HTTP session memory. The fix (commit 35f5ebdbcf) was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The defense mechanism (allowMultipleAuthorizationRequests field defaulting to false) limits storage to one authorization request per session by default, preventing the DoS attack. The vulnerable pattern (unbounded Map accumulation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "Spring Security 5.7.14 is not affected by CVE-2021-22119. The vulnerability allowed attackers to exhaust system resources by sending multiple OAuth2 authorization requests that accumulated unboundedly in HTTP session memory. The fix (commit 35f5ebdbcf) was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The defense mechanism (allowMultipleAuthorizationRequests field defaulting to false) limits storage to one authorization request per session by default, preventing the DoS attack. The vulnerable pattern (unbounded Map accumulation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T05:14:07.650164+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976: Target Spring Security 5.7.14 is not affected. The vulnerability (integer overflow in BCrypt causing zero salt rounds when log_rounds=31) was fixed in upstream commit a40f73521c (June 2021). The fix changed rounds calculation from int to long arithmetic, preventing the overflow that caused zero iterations. This fix shipped in upstream Spring Security 5.7.4 and all subsequent ver...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976: Target Spring Security 5.7.14 is not affected. The vulnerability (integer overflow in BCrypt causing zero salt rounds when log_rounds=31) was fixed in upstream commit a40f73521c (June 2021). The fix changed rounds calculation from int to long arithmetic, preventing the overflow that caused zero iterations. This fix shipped in upstream Spring Security 5.7.4 and all subsequent ver..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2022-22978: Spring Security 5.7.14 is NOT AFFECTED. The vulnerability (RegexRequestMatcher authorization bypass via newline characters in paths) was fixed in upstream commit c6461d61babfcf92febfd0a85785623e53190a8f (May 12, 2022) and was already included in the Spring Security 5.7.14 release (November 18, 2024) before TuxCare onboarded it (March 23, 2026). The target code has Pattern.DOTALL set as the default regex flag, which makes the '.' metacharacter match newline characters, preventing the bypass. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978: Spring Security 5.7.14 is NOT AFFECTED. The vulnerability (RegexRequestMatcher authorization bypass via newline characters in paths) was fixed in upstream commit c6461d61babfcf92febfd0a85785623e53190a8f (May 12, 2022) and was already included in the Spring Security 5.7.14 release (November 18, 2024) before TuxCare onboarded it (March 23, 2026). The target code has Pattern.DOTALL set as the default regex flag, which makes the '.' metacharacter match newline characters, preventing the bypass. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2022-31692 is NOT present in Spring Security 5.7.14-tuxcare.10. The vulnerability involved AuthorizationFilter incorrectly extending OncePerRequestFilter, which caused authorization checks to be skipped on forward/include dispatcher types. The upstream fix (commit 1f481aafff) changed the filter to extend GenericFilterBean with manual dispatcher-type control. This fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded, before any TuxCare modifications. The target code correctly extends GenericFilterBean and implements all dispatcher control mechanisms (observeOncePerRequest, filterErrorDispatch, filterAsyncDispatch, skipDispatch method). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 is NOT present in Spring Security 5.7.14-tuxcare.10. The vulnerability involved AuthorizationFilter incorrectly extending OncePerRequestFilter, which caused authorization checks to be skipped on forward/include dispatcher types. The upstream fix (commit 1f481aafff) changed the filter to extend GenericFilterBean with manual dispatcher-type control. This fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded, before any TuxCare modifications. The target code correctly extends GenericFilterBean and implements all dispatcher control mechanisms (observeOncePerRequest, filterErrorDispatch, filterAsyncDispatch, skipDispatch method). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T22:41:56.731102+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 is NOT present in Spring Security 5.7.14-tuxcare.10. The vulnerability (logout not properly cleaning serialized security context from HTTP session) was fixed by the upstream Spring Security project in commit 2d52fb8e4b, which shipped in version 5.7.14. Both required fixes are present: (1) SecurityContextLogoutHandler saves an empty security context to the repository during logout...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 is NOT present in Spring Security 5.7.14-tuxcare.10. The vulnerability (logout not properly cleaning serialized security context from HTTP session) was fixed by the upstream Spring Security project in commit 2d52fb8e4b, which shipped in version 5.7.14. Both required fixes are present: (1) SecurityContextLogoutHandler saves an empty security context to the repository during logout..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:00.057265+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). The upstream fix was released in 5.7.12, and version 5.7.14 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.7.12), CVE record (last affected 5.7.11), Snyk (fixed in 5.7.12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). The upstream fix was released in 5.7.12, and version 5.7.14 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.7.12), CVE record (last affected 5.7.11), Snyk (fixed in 5.7.12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.14-tuxcare.10 is not affected by CVE-2024-38810. The vulnerability concerns missing authorization when using the @AuthorizeReturnObject annotation, which is a feature introduced in Spring Security 6.3.0. This annotation does not exist in version 5.7.14, making the vulnerability inapplicable to this target version. The target uses older authorization mechanisms (@PreAuthorize...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.14-tuxcare.10 is not affected by CVE-2024-38810. The vulnerability concerns missing authorization when using the @AuthorizeReturnObject annotation, which is a feature introduced in Spring Security 6.3.0. This annotation does not exist in version 5.7.14, making the vulnerability inapplicable to this target version. The target uses older authorization mechanisms (@PreAuthorize..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T19:59:27.093399+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38827 affects Spring Security versions that use toLowerCase/toUpperCase without explicit Locale arguments in authorization code, potentially causing authorization bypass via locale-specific character transformations (e.g., Turkish 'i'/'I'). The target (Spring Security 5.7.14-tuxcare.10) is NOT AFFECTED because the fix was already included in the upstream 5.7.14 release on 2024-11-18. C...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38827 affects Spring Security versions that use toLowerCase/toUpperCase without explicit Locale arguments in authorization code, potentially causing authorization bypass via locale-specific character transformations (e.g., Turkish 'i'/'I'). The target (Spring Security 5.7.14-tuxcare.10) is NOT AFFECTED because the fix was already included in the upstream 5.7.14 release on 2024-11-18. C..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:11.003578+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T10:48:29.606694+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.14 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.14 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T11:36:43.630807+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.7.14 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 5.7.14 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.14 is not affected by CVE-2026-22751. The vulnerable component `JdbcOneTimeTokenService` does not exist in this version. The one-time token authentication feature was introduced in Spring Security 6.4.0, which is significantly later than version 5.7.14. Exhaustive searches confirmed no OneTimeToken classes, interfaces, or related code exist in the target repository at HEAD (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.14 is not affected by CVE-2026-22751. The vulnerable component `JdbcOneTimeTokenService` does not exist in this version. The one-time token authentication feature was introduced in Spring Security 6.4.0, which is significantly later than version 5.7.14. Exhaustive searches confirmed no OneTimeToken classes, interfaces, or related code exist in the target repository at HEAD (..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-15T17:28:00.089399+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 5.7.14-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 5.7.14-tuxcare.8."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.14 is not affected by CVE-2026-59277. The vulnerable component, `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` builder methods, does not exist in this version. The CVE concerns a feature introduced in a later version of Spring Security where the internal/external IP address classification failed to recognize IPv4/IPv6 \"any local\" address...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.14 is not affected by CVE-2026-59277. The vulnerable component, `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` builder methods, does not exist in this version. The CVE concerns a feature introduced in a later version of Spring Security where the internal/external IP address classification failed to recognize IPv4/IPv6 \"any local\" address..."
    }
  ]
}