{
  "@id": "urn:uuid:8cd53551-827f-4b79-b67b-2bbcfb512abf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:19:54.137004+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T20:54:55.639771+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.1.6 is NOT affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolon-delimited segments like /secured/admin.html;x=user.html) to URLs. The fix, which strips path parameters before security pattern matching, was introduced in Spring Security 2.0.6/3.0.4 (circa 2010) by upstream developer Luke Ta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.1.6 is NOT affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolon-delimited segments like /secured/admin.html;x=user.html) to URLs. The fix, which strips path parameters before security pattern matching, was introduced in Spring Security 2.0.6/3.0.4 (circa 2010) by upstream developer Luke Ta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:26:00.148611+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.1.6 is not affected by CVE-2011-2731. The vulnerability involved storing RunAs Authentication in a shared SecurityContext, enabling race conditions where one thread could access another thread's elevated privileges. Both required fixes (SEC-1750: creating isolated SecurityContext instances for each RunAs operation, and SEC-1967: ensuring SecurityContext restoration ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.1.6 is not affected by CVE-2011-2731. The vulnerability involved storing RunAs Authentication in a shared SecurityContext, enabling race conditions where one thread could access another thread's elevated privileges. Both required fixes (SEC-1750: creating isolated SecurityContext instances for each RunAs operation, and SEC-1967: ensuring SecurityContext restoration ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:03:51.446853+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 CRLF injection vulnerability is NOT present in Spring Security 6.1.6. The upstream vendor (Spring Security project) fixed this vulnerability in versions 2.0.7 and 3.0.6 back in 2011. The target version (6.1.6, released 2023) shipped with both defense layers already in place: (1) FirewalledResponse class that validates and rejects redirect locations containing CR/LF characters, and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 CRLF injection vulnerability is NOT present in Spring Security 6.1.6. The upstream vendor (Spring Security project) fixed this vulnerability in versions 2.0.7 and 3.0.6 back in 2011. The target version (6.1.6, released 2023) shipped with both defense layers already in place: (1) FirewalledResponse class that validates and rejects redirect locations containing CR/LF characters, and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T22:43:09.877592+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 affects Spring Security's RMI remoting functionality, specifically the ContextPropagatingRemoteInvocation class which deserialized SecurityContext objects from untrusted clients. The target (Spring Security 6.1.6-tuxcare.10) is NOT AFFECTED because the entire remoting module was removed by upstream Spring Security in commit b2e6c60d94 (2021-10-13), before TuxCare onboarded version...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security's RMI remoting functionality, specifically the ContextPropagatingRemoteInvocation class which deserialized SecurityContext objects from untrusted clients. The target (Spring Security 6.1.6-tuxcare.10) is NOT AFFECTED because the entire remoting module was removed by upstream Spring Security in commit b2e6c60d94 (2021-10-13), before TuxCare onboarded version..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T21:13:17.779845+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.6 is not affected by CVE-2012-5055. The timing-attack mitigation (SEC-2056) was implemented in the upstream Spring Security project by Rob Winch in 2012 and has been part of all subsequent releases. The target version 6.1.6 contains the complete fix: DaoAuthenticationProvider performs password hashing/validation even when a user is not found, ensuring consistent response tim...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.6 is not affected by CVE-2012-5055. The timing-attack mitigation (SEC-2056) was implemented in the upstream Spring Security project by Rob Winch in 2012 and has been part of all subsequent releases. The target version 6.1.6 contains the complete fix: DaoAuthenticationProvider performs password hashing/validation even when a user is not found, ensuring consistent response tim..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T17:02:30.885063+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 6.1.6 is NOT affected by CVE-2014-3527. The vulnerability (CAS proxy ticket authentication using untrusted HTTP headers for host/port/scheme) was fixed in upstream Spring Security commit 934937d9c1 (July 2014) by Rob Winch. This fix was already present in the upstream Spring Security 6.1.6 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (1df57f122d \"Tuxcare setup for 6.1.6\"). The target code correctly uses the configured CAS service URL from ServiceProperties instead of HTTP request headers when building the service URL for proxy ticket authentication.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target Spring Security 6.1.6 is NOT affected by CVE-2014-3527. The vulnerability (CAS proxy ticket authentication using untrusted HTTP headers for host/port/scheme) was fixed in upstream Spring Security commit 934937d9c1 (July 2014) by Rob Winch. This fix was already present in the upstream Spring Security 6.1.6 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (1df57f122d \"Tuxcare setup for 6.1.6\"). The target code correctly uses the configured CAS service URL from ServiceProperties instead of HTTP request headers when building the service URL for proxy ticket authentication."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:59.702907+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2016-5007 addresses authorization bypass via URL pattern matching discrepancies between Spring Security and Spring MVC. The target (Spring Security 6.1.6) contains both upstream fixes from 2016: (1) MvcRequestMatcher that aligns Spring Security's authorization matching with Spring MVC's controller resolution using HandlerMappingIntrospector, and (2) DefaultHttpFirewall blocking URL-encoded slashes (%2f/%2F). In Spring Security 6.x, requestMatchers() automatically uses MvcRequestMatcher when Spring MVC is present, and StrictHttpFirewall (the default) provides comprehensive protection against encoded slashes and other malicious patterns. Both fixes were IN_UPSTREAM_RELEASE before TuxCare setup (commit 1df57f122d), authored by upstream maintainer Rob Winch. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses authorization bypass via URL pattern matching discrepancies between Spring Security and Spring MVC. The target (Spring Security 6.1.6) contains both upstream fixes from 2016: (1) MvcRequestMatcher that aligns Spring Security's authorization matching with Spring MVC's controller resolution using HandlerMappingIntrospector, and (2) DefaultHttpFirewall blocking URL-encoded slashes (%2f/%2F). In Spring Security 6.x, requestMatchers() automatically uses MvcRequestMatcher when Spring MVC is present, and StrictHttpFirewall (the default) provides comprehensive protection against encoded slashes and other malicious patterns. Both fixes were IN_UPSTREAM_RELEASE before TuxCare setup (commit 1df57f122d), authored by upstream maintainer Rob Winch. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:46.571739+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2016-9879 affects Spring Security versions 3.2.0-3.2.9, 4.0.x-4.1.3, and 4.2.0. The target is Spring Security 6.1.6, which includes the upstream fix from December 2016 (commit 666e356ebc). The fix detects and rejects requests containing URL-encoded slashes (\"%2f\" or \"%2F\") in the requestURI, preventing security constraint bypass. The vulnerable pattern is not present in this version as the upstream vendor (Rob Winch from Pivotal) applied the fix before Spring Security 6.1.6 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "CVE-2016-9879 affects Spring Security versions 3.2.0-3.2.9, 4.0.x-4.1.3, and 4.2.0. The target is Spring Security 6.1.6, which includes the upstream fix from December 2016 (commit 666e356ebc). The fix detects and rejects requests containing URL-encoded slashes (\"%2f\" or \"%2F\") in the requestURI, preventing security constraint bypass. The vulnerable pattern is not present in this version as the upstream vendor (Rob Winch from Pivotal) applied the fix before Spring Security 6.1.6 was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2017-4995 is NOT present in the target. The vulnerability (unrestricted Jackson default typing allowing arbitrary class deserialization leading to code execution) was fixed by upstream Spring Security in May 2017 via commit 5dee8534cd. The target version 5.6.5-tuxcare.1 includes this upstream fix. The defense mechanism (AllowlistTypeIdResolver) validates all classes before deserialization, requiring them to be either in a hardcoded allowlist, have explicit mixin configuration, or be Jackson-annotated. The fix was authored by Rob Winch (rwinch@users.noreply.github.com) and was included in the upstream release that TuxCare onboarded in January 2026, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "CVE-2017-4995 is NOT present in the target. The vulnerability (unrestricted Jackson default typing allowing arbitrary class deserialization leading to code execution) was fixed by upstream Spring Security in May 2017 via commit 5dee8534cd. The target version 5.6.5-tuxcare.1 includes this upstream fix. The defense mechanism (AllowlistTypeIdResolver) validates all classes before deserialization, requiring them to be either in a hardcoded allowlist, have explicit mixin configuration, or be Jackson-annotated. The fix was authored by Rob Winch (rwinch@users.noreply.github.com) and was included in the upstream release that TuxCare onboarded in January 2026, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:24.708688+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 6.1.6. The vulnerability, which allowed bypassing security constraints via semicolons and special encodings in URL path parameters, was fixed by the upstream vendor (Rob Winch) in commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2. This fix introduced StrictHttpFirewall, which rejects URLs containing semicolons (`;`, `%3b`, `%3B`), encoded slashes, a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 6.1.6. The vulnerability, which allowed bypassing security constraints via semicolons and special encodings in URL path parameters, was fixed by the upstream vendor (Rob Winch) in commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2. This fix introduced StrictHttpFirewall, which rejects URLs containing semicolons (`;`, `%3b`, `%3B`), encoded slashes, a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2018-15801 affects Spring Security's JWT issuer validation where issuer values were compared using Java's URL.equals() method, which can perform DNS lookups and consider different URL strings equal if they resolve to the same IP. The target Spring Security 6.1.6 contains the upstream fix from November 2018 (commit 19649db9) that changed the comparison to use string equality instead. The current implementation uses a Predicate with string comparison: issuer.equals(claimValue.toString()), which is semantically equivalent to the fix. This is an upstream fix that shipped in the Spring Security 6.1.6 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 affects Spring Security's JWT issuer validation where issuer values were compared using Java's URL.equals() method, which can perform DNS lookups and consider different URL strings equal if they resolve to the same IP. The target Spring Security 6.1.6 contains the upstream fix from November 2018 (commit 19649db9) that changed the comparison to use string equality instead. The current implementation uses a Predicate with string comparison: issuer.equals(claimValue.toString()), which is semantically equivalent to the fix. This is an upstream fix that shipped in the Spring Security 6.1.6 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 6.1.6 is NOT affected by CVE-2019-11272. The vulnerable class `PlaintextPasswordEncoder` (from the deprecated `org.springframework.security.authentication.encoding` package) does not exist in this version. It was removed by upstream Spring Security in commit 12dbf2e961 on 2017-10-23, years before the CVE was disclosed in 2019. Version 6.1.6 uses the modern `org.springframework.security.crypto.password` architecture. The CVE only affects versions 4.2.x up to 4.2.12 and older unsupported versions that contained the vulnerable class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 6.1.6 is NOT affected by CVE-2019-11272. The vulnerable class `PlaintextPasswordEncoder` (from the deprecated `org.springframework.security.authentication.encoding` package) does not exist in this version. It was removed by upstream Spring Security in commit 12dbf2e961 on 2017-10-23, years before the CVE was disclosed in 2019. Version 6.1.6 uses the modern `org.springframework.security.crypto.password` architecture. The CVE only affects versions 4.2.x up to 4.2.12 and older unsupported versions that contained the vulnerable class.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T23:54:12.578535+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 does not affect Spring Security 6.1.6. The vulnerability involved insecure randomness when using SecureRandomFactoryBean#setSeed, where a custom seed would replace the entire SecureRandom internal state, causing instances with identical seeds to produce identical random sequences. The upstream fix (commit 9c1eac79e2, March 2019) reordered the code to call nextBytes() BEFORE setSee...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 does not affect Spring Security 6.1.6. The vulnerability involved insecure randomness when using SecureRandomFactoryBean#setSeed, where a custom seed would replace the entire SecureRandom internal state, causing instances with identical seeds to produce identical random sequences. The upstream fix (commit 9c1eac79e2, March 2019) reordered the code to call nextBytes() BEFORE setSee..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:54.137004+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. Version 6.1.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected below 5.3.2), NVD (affected below 5.3.2), CVE record (affected below 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Version 6.1.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected below 5.3.2), NVD (affected below 5.3.2), CVE record (affected below 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T22:04:34.504014+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 targets the queryableText() method in Spring Security's Encryptors class, which created a text encryptor using a fixed null initialization vector with CBC mode. This method does not exist in Spring Security 6.1.6. It was deprecated by upstream in April 2020 (the CVE fix commit db155b3094) and completely removed in September 2022 (commit d996c2a2c6), both well before this version w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 targets the queryableText() method in Spring Security's Encryptors class, which created a text encryptor using a fixed null initialization vector with CBC mode. This method does not exist in Spring Security 6.1.6. It was deprecated by upstream in April 2020 (the CVE fix commit db155b3094) and completely removed in September 2022 (commit d996c2a2c6), both well before this version w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 6.1.6 is not affected by CVE-2021-22119. The upstream vendor fix (commit 35f5ebdbcf) that prevents DoS via unbounded OAuth2 authorization request accumulation was included in the 6.1.6 release. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations now store only ONE authorization request per session instead of accumulating multiple requests in a Map. The vulnerable pattern (Map-based unbounded accumulation) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target Spring Security 6.1.6 is not affected by CVE-2021-22119. The upstream vendor fix (commit 35f5ebdbcf) that prevents DoS via unbounded OAuth2 authorization request accumulation was included in the 6.1.6 release. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations now store only ONE authorization request per session instead of accumulating multiple requests in a Map. The vulnerable pattern (Map-based unbounded accumulation) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:12:00.099497+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Target version 6.1.6 is NOT vulnerable to CVE-2022-22976. The integer overflow vulnerability in BCrypt's rounds calculation was fixed by upstream Spring Security in commit 3f13fa0285 (June 2021, released in v5.8.0). The fix replaces the vulnerable int-based bit shift `rounds = 1 << log_rounds` (which overflows to negative when log_rounds=31) with a long-based calculation `rounds = roundsForLogR...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Target version 6.1.6 is NOT vulnerable to CVE-2022-22976. The integer overflow vulnerability in BCrypt's rounds calculation was fixed by upstream Spring Security in commit 3f13fa0285 (June 2021, released in v5.8.0). The fix replaces the vulnerable int-based bit shift `rounds = 1 << log_rounds` (which overflows to negative when log_rounds=31) with a long-based calculation `rounds = roundsForLogR..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2022-22978 is NOT present in Spring Security 6.1.6. The vulnerability concerns RegexRequestMatcher's handling of regex patterns containing `.` which, without the Pattern.DOTALL flag, would not match line terminators (\\n, \\r), allowing attackers to bypass authorization checks by injecting newline characters in request paths. The fix (adding Pattern.DOTALL) was already present in the upstream Spring Security release that TuxCare onboarded. Commit 472c25b5e8 by Rob Winch (May 12, 2022) introduced the fix, and this commit is an ancestor of the first TuxCare commit (1df57f122d \"Tuxcare setup for 6.1.6\"). The target code at web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java:46-48,105 shows DEFAULT = Pattern.DOTALL is already applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 is NOT present in Spring Security 6.1.6. The vulnerability concerns RegexRequestMatcher's handling of regex patterns containing `.` which, without the Pattern.DOTALL flag, would not match line terminators (\\n, \\r), allowing attackers to bypass authorization checks by injecting newline characters in request paths. The fix (adding Pattern.DOTALL) was already present in the upstream Spring Security release that TuxCare onboarded. Commit 472c25b5e8 by Rob Winch (May 12, 2022) introduced the fix, and this commit is an ancestor of the first TuxCare commit (1df57f122d \"Tuxcare setup for 6.1.6\"). The target code at web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java:46-48,105 shows DEFAULT = Pattern.DOTALL is already applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2022-31692 affects Spring Security 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9. The target is Spring Security 6.1.6-tuxcare.9, which contains the upstream fix (commit 1f481aafff) that shipped in the upstream 6.1.6 release before TuxCare onboarded it. The vulnerable pattern (AuthorizationFilter extending OncePerRequestFilter without proper dispatcher-type handling) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 affects Spring Security 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9. The target is Spring Security 6.1.6-tuxcare.9, which contains the upstream fix (commit 1f481aafff) that shipped in the upstream 6.1.6 release before TuxCare onboarded it. The vulnerable pattern (AuthorizationFilter extending OncePerRequestFilter without proper dispatcher-type handling) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T22:43:54.379537+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.6-tuxcare.9 is NOT AFFECTED by CVE-2023-20862. The vulnerability (logout failing to clear serialized security context from HTTP session) was fixed in upstream Spring Security via commits 2d52fb8e4bffca409b2c7bd18a01a8eb5cfd7451 and 8d664bc4c2938c771e13783b08a9c6654bb512f6 on April 17, 2023. These fixes were included in Spring Security 6.0.3 (April 2023) and all 6.1.x release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.6-tuxcare.9 is NOT AFFECTED by CVE-2023-20862. The vulnerability (logout failing to clear serialized security context from HTTP session) was fixed in upstream Spring Security via commits 2d52fb8e4bffca409b2c7bd18a01a8eb5cfd7451 and 8d664bc4c2938c771e13783b08a9c6654bb512f6 on April 17, 2023. These fixes were included in Spring Security 6.0.3 (April 2023) and all 6.1.x release..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 is fixed in version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.6-tuxcare.9 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation which does not exist in this version. The feature was introduced in Spring Security 6.3.0, released after version 6.1.6. Exhaustive searches across the repository confirm no @AuthorizeReturnObject annotation, supporting classes, or similar return-object authorizati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.6-tuxcare.9 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation which does not exist in this version. The feature was introduced in Spring Security 6.3.0, released after version 6.1.6. Exhaustive searches across the repository confirm no @AuthorizeReturnObject annotation, supporting classes, or similar return-object authorizati..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:15:57.456054+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.6 is not affected by CVE-2025-22223. The vulnerable class `UniqueSecurityAnnotationScanner` was introduced in version 6.4.0 as part of a major refactoring of the annotation scanning mechanism. Version 6.1.6 uses a different implementation (`AuthorizationAnnotationUtils.findUniqueAnnotation` with Spring Framework's `AopUtils.getMostSpecificMethod` and `AnnotationUtils.findAnn...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.6 is not affected by CVE-2025-22223. The vulnerable class `UniqueSecurityAnnotationScanner` was introduced in version 6.4.0 as part of a major refactoring of the annotation scanning mechanism. Version 6.1.6 uses a different implementation (`AuthorizationAnnotationUtils.findUniqueAnnotation` with Spring Framework's `AopUtils.getMostSpecificMethod` and `AnnotationUtils.findAnn..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 6.1.6-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 6.1.6-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:49:55.998641+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.1.6 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.1.6 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T11:37:35.533056+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 6.1.6 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 6.1.6 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 affects version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 6.1.6-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      },
      "action_statement": "Vulnerability CVE-2026-22746 affects version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 6.1.6-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.6 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) does not exist in this version. The OTT authentication feature was introduced in Spring Security 6.4.0, released after version 6.1.6. Exhaustive searches for JdbcOneTimeTokenService, OneTimeToken classes, and the org.springframework.sec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.6 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) does not exist in this version. The OTT authentication feature was introduced in Spring Security 6.4.0, released after version 6.1.6. Exhaustive searches for JdbcOneTimeTokenService, OneTimeToken classes, and the org.springframework.sec..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:58:00.121837+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 6.1.6-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 6.1.6-tuxcare.8."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.1.6-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.6 is NOT AFFECTED by CVE-2026-59277. The vulnerable component (InetAddressMatchers utility class with matchInternal() and matchExternal() builders) does not exist in this version. This feature was introduced in a later version (after 6.4.0, likely 6.6.x or later). The target version only contains IpAddressMatcher for CIDR range matching, which is a different feature that doe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.6 is NOT AFFECTED by CVE-2026-59277. The vulnerable component (InetAddressMatchers utility class with matchInternal() and matchExternal() builders) does not exist in this version. This feature was introduced in a later version (after 6.4.0, likely 6.6.x or later). The target version only contains IpAddressMatcher for CIDR range matching, which is a different feature that doe..."
    }
  ]
}