{
  "@id": "urn:uuid:33fb055d-43cf-407c-be03-92f4c1212486",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 49,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:38:00.054920+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-core 5.8.16-tuxcare.7. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-core 5.8.16-tuxcare.7. CVE-2007-1652 is a vulnerability in JanRain's myOpenID service, on the OpenID Provider side. The CVE record carries vendor and product \\\"n/a\\\" and a single version-unbounded CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's myOpenID security announcement of March 2007 and the openid.net security mailing list threads of the same month. The reported mechanism - a crafted web page that forcibly logs a user into an OpenID-enabled site, releases the user's personal information to it, and silently adds it to the user's trusted-sites list by way of a cached authentication token - consists entirely of decisions taken by an OpenID Provider. A relying party has no trusted-sites list and no auto-approval step at which the flaw could occur. The openid module of this library implements only the relying-party (consumer) role: OpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps openid4java's ConsumerManager. The tree contains no OpenID Provider implementation - no use of openid4java's server package or ServerManager - and no trusted-sites or auto-approval handling anywhere. Nor could this library have been affected when the issue was disclosed: the CVE was published on 24 March 2007, while the earliest OpenID code in the project dates from 20 April 2007 and only reached the shipped openid module in January 2008. The vulnerability therefore does not apply to this library in any version.",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "CVE-2007-1652 is a vulnerability in JanRain's myOpenID service, on the OpenID Provider side. The CVE record carries vendor and product \\\"n/a\\\" and a single version-unbounded CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's myOpenID security announcement of March 2007 and the openid.net security mailing list threads of the same month. The reported mechanism - a crafted web page that forcibly logs a user into an OpenID-enabled site, releases the user's personal information to it, and silently adds it to the user's trusted-sites list by way of a cached authentication token - consists entirely of decisions taken by an OpenID Provider. A relying party has no trusted-sites list and no auto-approval step at which the flaw could occur. The openid module of this library implements only the relying-party (consumer) role: OpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps openid4java's ConsumerManager. The tree contains no OpenID Provider implementation - no use of openid4java's server package or ServerManager - and no trusted-sites or auto-approval handling anywhere. Nor could this library have been affected when the issue was disclosed: the CVE was published on 24 March 2007, while the earliest OpenID code in the project dates from 20 April 2007 and only reached the shipped openid module in January 2008. The vulnerability therefore does not apply to this library in any version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T20:49:00.095017+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.16 is not affected by CVE-2010-3700. The vulnerability was fixed in Spring Security 3.0.4 (October 2010) and the fix is present in the upstream 5.8.16 release. The target contains the HttpFirewall framework with RequestWrapper that strips path parameters (semicolon-delimited segments) from servletPath and pathInfo before security pattern matching. The default StrictHttpFirew...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.16 is not affected by CVE-2010-3700. The vulnerability was fixed in Spring Security 3.0.4 (October 2010) and the fix is present in the upstream 5.8.16 release. The target contains the HttpFirewall framework with RequestWrapper that strips path parameters (semicolon-delimited segments) from servletPath and pathInfo before security pattern matching. The default StrictHttpFirew..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T19:21:00.085443+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 5.8.16. The race condition vulnerability in RunAsManager that allowed privilege escalation through a shared SecurityContext has been completely fixed by upstream Spring Security. The target contains both SEC-1750 (isolating RunAs authentication in a new SecurityContext) and SEC-1967 (ensuring cleanup in finally blocks) fixes, authored by upstream ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 5.8.16. The race condition vulnerability in RunAsManager that allowed privilege escalation through a shared SecurityContext has been completely fixed by upstream Spring Security. The target contains both SEC-1750 (isolating RunAs authentication in a new SecurityContext) and SEC-1967 (ensuring cleanup in finally blocks) fixes, authored by upstream ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T22:55:47.899409+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is not present in Spring Security 5.8.16. The vulnerability required unvalidated redirect URLs containing CR/LF characters to enable HTTP response splitting. The target contains the upstream fix authored by Luke Taylor (SpringSource) in 2011, which validates all redirect locations for CR/LF characters and rejects them before sending. This fix wa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is not present in Spring Security 5.8.16. The vulnerability required unvalidated redirect URLs containing CR/LF characters to enable HTTP response splitting. The target contains the upstream fix authored by Luke Taylor (SpringSource) in 2011, which validates all redirect locations for CR/LF characters and rejects them before sending. This fix wa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T22:35:49.573803+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 concerns Java deserialization vulnerabilities in Spring Security 2.x-3.x where ContextPropagatingRemoteInvocation serialized entire SecurityContext objects, enabling arbitrary code execution via malicious object payloads. The target (Spring Security 5.8.16) contains the upstream vendor's fix (SEC-1741) applied in May 2011 by Luke Taylor. The vulnerable pattern has been completely ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 concerns Java deserialization vulnerabilities in Spring Security 2.x-3.x where ContextPropagatingRemoteInvocation serialized entire SecurityContext objects, enabling arbitrary code execution via malicious object payloads. The target (Spring Security 5.8.16) contains the upstream vendor's fix (SEC-1741) applied in May 2011 by Luke Taylor. The vulnerable pattern has been completely ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T21:07:46.273258+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 (username enumeration via timing side-channel in DaoAuthenticationProvider) is NOT present in Spring Security 5.8.16. The vulnerability was fixed by the upstream vendor (VMware/Spring Security) in version 3.1.3.RELEASE (September 2012) via commit c076f0f2e190c73a17379d05935c2c81657adee9 by Rob Winch. The target version 5.8.16 inherited this fix from the upstream release. The defen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (username enumeration via timing side-channel in DaoAuthenticationProvider) is NOT present in Spring Security 5.8.16. The vulnerability was fixed by the upstream vendor (VMware/Spring Security) in version 3.1.3.RELEASE (September 2012) via commit c076f0f2e190c73a17379d05935c2c81657adee9 by Rob Winch. The target version 5.8.16 inherited this fix from the upstream release. The defen..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T16:28:24.077355+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.8.16 is not affected by CVE-2014-3527. The vulnerability was fixed in upstream Spring Security versions 3.2.5 and 3.1.7 (released August 2014), and the fix is present in version 5.8.16. The target code uses pre-configured trusted service URLs from ServiceProperties instead of untrusted HTTP request headers when constructing CAS service URLs for proxy ticket authentication.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "Spring Security 5.8.16 is not affected by CVE-2014-3527. The vulnerability was fixed in upstream Spring Security versions 3.2.5 and 3.1.7 (released August 2014), and the fix is present in version 5.8.16. The target code uses pre-configured trusted service URLs from ServiceProperties instead of untrusted HTTP request headers when constructing CAS service URLs for proxy ticket authentication."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.8.16 is not affected by CVE-2016-5007. The vulnerability involved inconsistent URL pattern matching between Spring Security's authorization rules and Spring MVC's controller routing, allowing attackers to bypass security constraints using URL variations (trailing slashes, encoded characters, etc.). The target contains complete upstream fixes: (1) MvcRequestMatcher class (introduced in 4.1.1.RELEASE) provides Spring MVC-consistent URL matching for authorization rules; (2) URL-encoded slash blocking in HttpFirewall implementations (added in 4.2.1.RELEASE); (3) StrictHttpFirewall as the default firewall (since 4.2.4) which blocks encoded slashes and other bypass techniques. All fixes were authored by upstream (rwinch@gopivotal.com) and shipped in upstream releases before TuxCare onboarded version 5.8.16, meaning the vulnerable pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 5.8.16 is not affected by CVE-2016-5007. The vulnerability involved inconsistent URL pattern matching between Spring Security's authorization rules and Spring MVC's controller routing, allowing attackers to bypass security constraints using URL variations (trailing slashes, encoded characters, etc.). The target contains complete upstream fixes: (1) MvcRequestMatcher class (introduced in 4.1.1.RELEASE) provides Spring MVC-consistent URL matching for authorization rules; (2) URL-encoded slash blocking in HttpFirewall implementations (added in 4.2.1.RELEASE); (3) StrictHttpFirewall as the default firewall (since 4.2.4) which blocks encoded slashes and other bypass techniques. All fixes were authored by upstream (rwinch@gopivotal.com) and shipped in upstream releases before TuxCare onboarded version 5.8.16, meaning the vulnerable pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:19.723998+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.8.16-tuxcare.16 is NOT affected by CVE-2016-9879. The vulnerability allows bypassing security constraints by using URL-encoded slash characters (%2f or %2F) in request URIs, exploiting differences in how servlet containers handle path parameters. The fix (which rejects requests containing encoded slashes) was introduced by upstream Spring Security in commit 666e356ebc4 (December 2016) and released in versions 3.2.10, 4.1.4, and 4.2.1. This upstream fix was already present in Spring Security 5.8.16 when TuxCare onboarded it, as confirmed by commit ancestry analysis showing the fix predates the first TuxCare commit (f09fc6dd88). The target code includes the complete defense: the allowUrlEncodedSlash field, containsInvalidUrlEncodedSlash() validation method, and the enforcement check in getFirewalledRequest() that throws RequestRejectedException when encoded slashes are detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Spring Security 5.8.16-tuxcare.16 is NOT affected by CVE-2016-9879. The vulnerability allows bypassing security constraints by using URL-encoded slash characters (%2f or %2F) in request URIs, exploiting differences in how servlet containers handle path parameters. The fix (which rejects requests containing encoded slashes) was introduced by upstream Spring Security in commit 666e356ebc4 (December 2016) and released in versions 3.2.10, 4.1.4, and 4.2.1. This upstream fix was already present in Spring Security 5.8.16 when TuxCare onboarded it, as confirmed by commit ancestry analysis showing the fix predates the first TuxCare commit (f09fc6dd88). The target code includes the complete defense: the allowUrlEncodedSlash field, containsInvalidUrlEncodedSlash() validation method, and the enforcement check in getFirewalledRequest() that throws RequestRejectedException when encoded slashes are detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Target version 5.8.16 is not affected. The upstream fix (commit 5dee8534cd by Rob Winch, 2017-05-31) was already present in the upstream Spring Security release before TuxCare onboarding. The fix adds AllowlistTypeIdResolver that validates all classes during Jackson deserialization with default typing enabled, rejecting arbitrary class instantiation unless the class is whitelisted, has an explicit mixin, or is Jackson-annotated. The vulnerable pattern (unrestricted class deserialization) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Target version 5.8.16 is not affected. The upstream fix (commit 5dee8534cd by Rob Winch, 2017-05-31) was already present in the upstream Spring Security release before TuxCare onboarding. The fix adds AllowlistTypeIdResolver that validates all classes during Jackson deserialization with default typing enabled, rejecting arbitrary class instantiation unless the class is whitelisted, has an explicit mixin, or is Jackson-annotated. The vulnerable pattern (unrestricted class deserialization) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T16:41:53.192155+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 5.8.16. The vulnerability allowed attackers to bypass security constraints using URL path parameters with semicolons or special encodings. The upstream fix (commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2, January 24, 2018) introduced StrictHttpFirewall, which rejects requests containing semicolons (;, %3b, %3B) and other dangerous encoded charact...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 5.8.16. The vulnerability allowed attackers to bypass security constraints using URL path parameters with semicolons or special encodings. The upstream fix (commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2, January 24, 2018) introduced StrictHttpFirewall, which rejects requests containing semicolons (;, %3b, %3B) and other dangerous encoded charact..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.8.16 is not affected by CVE-2018-15801. The vulnerability (JWT issuer validation bypass via URL.equals() comparison) was fixed in upstream Spring Security and the fix was already present in the upstream release that TuxCare onboarded. The target uses string-based issuer comparison instead of URL object equality, eliminating the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "Spring Security 5.8.16 is not affected by CVE-2018-15801. The vulnerability (JWT issuer validation bypass via URL.equals() comparison) was fixed in upstream Spring Security and the fix was already present in the upstream release that TuxCare onboarded. The target uses string-based issuer comparison instead of URL object equality, eliminating the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:20:19.402749+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security version 5.8.16 is not affected by CVE-2019-11272. The vulnerable component (PlaintextPasswordEncoder class) was completely removed from the codebase in version 5.0.0 (October 2017), well before version 5.8.16 existed. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions. Version 5.x introduced a new password encoding architecture in the crypto.password package that does not have the vulnerable string concatenation pattern (null + \"\" = \"null\") that existed in the old PlaintextPasswordEncoder.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security version 5.8.16 is not affected by CVE-2019-11272. The vulnerable component (PlaintextPasswordEncoder class) was completely removed from the codebase in version 5.0.0 (October 2017), well before version 5.8.16 existed. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions. Version 5.x introduced a new password encoding architecture in the crypto.password package that does not have the vulnerable string concatenation pattern (null + \"\" = \"null\") that existed in the old PlaintextPasswordEncoder.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-02T23:53:16.670486+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.8.16 is not affected by CVE-2019-3795 (insecure randomness in SecureRandomFactoryBean). The vulnerability was fixed in upstream commit 9c1eac79e2 by Josh Cummings, which was included in the upstream release before TuxCare onboarding. The fix ensures SecureRandom's internal state is initialized with system entropy via nextBytes() before any user-provided seed is appl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.8.16 is not affected by CVE-2019-3795 (insecure randomness in SecureRandomFactoryBean). The vulnerability was fixed in upstream commit 9c1eac79e2 by Josh Cummings, which was included in the upstream release before TuxCare onboarding. The fix ensures SecureRandom's internal state is initialized with system entropy via nextBytes() before any user-provided seed is appl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-06T18:38:00.054920+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.8.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.8.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Version 5.8.16 is not vulnerable to CVE-2020-5408. No backport is needed. The fix was included in Spring Security 5.3.2, and version 5.8.16 already incorporates it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "Version 5.8.16 is not vulnerable to CVE-2020-5408. No backport is needed. The fix was included in Spring Security 5.3.2, and version 5.8.16 already incorporates it."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2021-22119 describes a DoS vulnerability in Spring Security OAuth2 Client where multiple authorization requests could exhaust session storage. The fix limits session storage to one authorization request by default. The target version (5.8.16-tuxcare.16) includes the upstream Spring Security 5.8.16 release which already contains the fix in both Web (commit 35f5ebdbcf) and WebFlux (commit 700bda68b7) implementations. Both fixes were authored by upstream Spring Security developers and were already present in the upstream release before TuxCare onboarding. The vulnerable pattern (unbounded session storage via Map) is not present in the target; the defense (single request storage) is active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 describes a DoS vulnerability in Spring Security OAuth2 Client where multiple authorization requests could exhaust session storage. The fix limits session storage to one authorization request by default. The target version (5.8.16-tuxcare.16) includes the upstream Spring Security 5.8.16 release which already contains the fix in both Web (commit 35f5ebdbcf) and WebFlux (commit 700bda68b7) implementations. Both fixes were authored by upstream Spring Security developers and were already present in the upstream release before TuxCare onboarding. The vulnerable pattern (unbounded session storage via Map) is not present in the target; the defense (single request storage) is active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T05:10:03.859518+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 is not present in this version. The integer overflow vulnerability in BCrypt's rounds calculation was fixed in upstream Spring Security commit 3f13fa0285 (June 2021) by Josh Cummings, which shipped in the upstream release before TuxCare's onboarding. The target code at 5.8.16-tuxcare.16 (SHA 8ff5eacf77) contains the complete fix: roundsForLogRounds method using long arithmetic (1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 is not present in this version. The integer overflow vulnerability in BCrypt's rounds calculation was fixed in upstream Spring Security commit 3f13fa0285 (June 2021) by Josh Cummings, which shipped in the upstream release before TuxCare's onboarding. The target code at 5.8.16-tuxcare.16 (SHA 8ff5eacf77) contains the complete fix: roundsForLogRounds method using long arithmetic (1..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. The target Spring Security 5.8.16 is NOT affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher bypass via newline characters in request paths) was fixed in the upstream release that TuxCare onboarded. The fix commit c6461d61ba (authored by Rob Winch) changed DEFAULT from 0 to Pattern.DOTALL, making the '.' regex metacharacter match newline characters and preventing authorization bypass. This upstream fix is present at HEAD (8ff5eacf77) and predates the first TuxCare commit (f09fc6dd88), confirming it shipped in the base upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "The target Spring Security 5.8.16 is NOT affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher bypass via newline characters in request paths) was fixed in the upstream release that TuxCare onboarded. The fix commit c6461d61ba (authored by Rob Winch) changed DEFAULT from 0 to Pattern.DOTALL, making the '.' regex metacharacter match newline characters and preventing authorization bypass. This upstream fix is present at HEAD (8ff5eacf77) and predates the first TuxCare commit (f09fc6dd88), confirming it shipped in the base upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2022-31692 affects Spring Security 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9. The vulnerability involved AuthorizationFilter incorrectly extending OncePerRequestFilter, which caused authorization checks to be silently skipped for FORWARD and INCLUDE dispatcher types. The target repository version 5.8.16 already contains the upstream fix (commit 1f481aafff by Marcus Da Coregio) that changes the base class to GenericFilterBean and implements explicit dispatcher type handling. This fix was shipped in the upstream Spring Security 5.8.16 release before TuxCare onboarded it, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 affects Spring Security 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9. The vulnerability involved AuthorizationFilter incorrectly extending OncePerRequestFilter, which caused authorization checks to be silently skipped for FORWARD and INCLUDE dispatcher types. The target repository version 5.8.16 already contains the upstream fix (commit 1f481aafff by Marcus Da Coregio) that changes the base class to GenericFilterBean and implements explicit dispatcher type handling. This fix was shipped in the upstream Spring Security 5.8.16 release before TuxCare onboarded it, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-02T22:42:49.576921+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 affects Spring Security versions 5.8.x prior to 5.8.3, where logout does not properly clean the security context when using serialized versions. The target repository is version 5.8.16-tuxcare.16, which includes the upstream fixes (commits 8d664bc4c2 and 2d52fb8e) that address this vulnerability. These fixes ensure that: (1) SecurityContextLogoutHandler explicitly saves an empty ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 affects Spring Security versions 5.8.x prior to 5.8.3, where logout does not properly clean the security context when using serialized versions. The target repository is version 5.8.16-tuxcare.16, which includes the upstream fixes (commits 8d664bc4c2 and 2d52fb8e) that address this vulnerability. These fixes ensure that: (1) SecurityContextLogoutHandler explicitly saves an empty ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:00.057265+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). The upstream fix was released in 5.8.11, and version 5.8.16 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.8.11), CVE record (last affected 5.8.10), Snyk (fixed in 5.8.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). The upstream fix was released in 5.8.11, and version 5.8.16 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.8.11), CVE record (last affected 5.8.10), Snyk (fixed in 5.8.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.16 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation and AuthorizationAdvisorProxyFactory class, which were introduced in Spring Security 6.3.0 (March 2024). Version 5.8.16 predates this feature by multiple major versions. The vulnerable code pattern does not exist in this version at all. Exhaustive searches confirmed no pres...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.16 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation and AuthorizationAdvisorProxyFactory class, which were introduced in Spring Security 6.3.0 (March 2024). Version 5.8.16 predates this feature by multiple major versions. The vulnerable code pattern does not exist in this version at all. Exhaustive searches confirmed no pres..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T19:57:58.593634+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38827 is NOT present in Spring Security 5.8.16. The vulnerability involves locale-dependent exceptions in String.toLowerCase() and String.toUpperCase() that could bypass authorization rules (e.g., Turkish locale where \"I\".toLowerCase() returns \"\u0131\" instead of \"i\"). The fix requiring explicit Locale.ROOT or Locale.ENGLISH arguments was already included in the upstream Spring Security 5.8...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38827 is NOT present in Spring Security 5.8.16. The vulnerability involves locale-dependent exceptions in String.toLowerCase() and String.toUpperCase() that could bypass authorization rules (e.g., Turkish locale where \"I\".toLowerCase() returns \"\u0131\" instead of \"i\"). The fix requiring explicit Locale.ROOT or Locale.ENGLISH arguments was already included in the upstream Spring Security 5.8..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T02:07:12.200727+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Target version 5.8.16 is NOT AFFECTED by CVE-2025-22223. The official Spring Security advisory explicitly lists only versions 6.4.0 through 6.4.3 as vulnerable. The vulnerable code (UniqueSecurityAnnotationScanner class) does not exist in 5.8.16 because it was introduced in version 6.4.0 (August 2024). Version 5.8.16 uses a different annotation scanning architecture based on Spring Framework's ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Target version 5.8.16 is NOT AFFECTED by CVE-2025-22223. The official Spring Security advisory explicitly lists only versions 6.4.0 through 6.4.3 as vulnerable. The vulnerable code (UniqueSecurityAnnotationScanner class) does not exist in 5.8.16 because it was introduced in version 6.4.0 (August 2024). Version 5.8.16 uses a different annotation scanning architecture based on Spring Framework's ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 is fixed in version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T10:48:29.606694+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.8.16 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.8.16 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 is a false positive for org.springframework.security:spring-security-core 5.8.16-tuxcare.7. direct vulnerability is in Spring Security project - affected versions are 6.4.0-6.4.10 and 6.5.0-6.5.4, version 5.8.16 is not in this range",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "direct vulnerability is in Spring Security project - affected versions are 6.4.0-6.4.10 and 6.5.0-6.5.4, version 5.8.16 is not in this range"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 affects version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core, and is fixed in 5.8.16-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      },
      "action_statement": "Vulnerability CVE-2026-22746 affects version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core, and is fixed in 5.8.16-tuxcare.8."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T05:44:28.674122+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.16 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) does not exist in this version. The One-Time Token login feature was introduced in Spring Security 6.1.0, released years after the 5.8.x branch. Exhaustive searches for JdbcOneTimeTokenService, OneTimeToken classes, and the org.springf...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.16 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) does not exist in this version. The One-Time Token login feature was introduced in Spring Security 6.1.0, released years after the 5.8.x branch. Exhaustive searches for JdbcOneTimeTokenService, OneTimeToken classes, and the org.springf..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T15:52:00.251973+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core, and is fixed in 5.8.16-tuxcare.16.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core, and is fixed in 5.8.16-tuxcare.16."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.8.16-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.16 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() methods) does not exist in this version. The CVE affects InetAddressMatchers.matchInternal() and matchExternal() utility methods that classify IP addresses as internal (private) or external (public) networks, which were introduced in a later version ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.16 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() methods) does not exist in this version. The CVE affects InetAddressMatchers.matchInternal() and matchExternal() utility methods that classify IP addresses as internal (private) or external (public) networks, which were introduced in a later version ..."
    }
  ]
}