{
  "@id": "urn:uuid:80b2160d-fc8a-4a4a-8b14-d9dfc66dcfc2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:43:00.057265+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2010-3700. The vulnerability (path parameter injection to bypass security constraints) was fixed in Spring Security 2.0.6 and 3.0.4 in October 2010 via SEC-1584. The fix introduced HttpFirewall infrastructure that strips semicolon-delimited path parameters from request paths before security pattern matching. This fix has been present in all Spring Se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2010-3700. The vulnerability (path parameter injection to bypass security constraints) was fixed in Spring Security 2.0.6 and 3.0.4 in October 2010 via SEC-1584. The fix introduced HttpFirewall infrastructure that strips semicolon-delimited path parameters from request paths before security pattern matching. This fix has been present in all Spring Se..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 describes a race condition in Spring Security's RunAsManager mechanism where the Authentication object was stored in the shared SecurityContext, allowing privilege escalation in multi-threaded environments. The vulnerability was fixed in Spring Security 2.0.7 and 3.0.6 (circa 2011). The target repository is Spring Security version 6.2.8-tuxcare.6, which already contains the upstre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 describes a race condition in Spring Security's RunAsManager mechanism where the Authentication object was stored in the shared SecurityContext, allowing privilege escalation in multi-threaded environments. The vulnerability was fixed in Spring Security 2.0.7 and 3.0.6 (circa 2011). The target repository is Spring Security version 6.2.8-tuxcare.6, which already contains the upstre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2011-2732. The vulnerability pattern is not present because both defense mechanisms from the vendor patches were already included in the upstream release. Defense 1: FirewalledResponse class validates all redirect URLs and rejects those containing CR/LF characters (introduced in 3.1.0.RC3 via SEC-1790). Defense 2: targetUrlParameter defaults to null,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2011-2732. The vulnerability pattern is not present because both defense mechanisms from the vendor patches were already included in the upstream release. Defense 1: FirewalledResponse class validates all redirect URLs and rejects those containing CR/LF characters (introduced in 3.1.0.RC3 via SEC-1790). Defense 2: targetUrlParameter defaults to null,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 does not affect Spring Security 6.2.8. The vulnerable code (ContextPropagatingRemoteInvocation.java and the entire remoting/rmi module) was completely removed from Spring Security in October 2021 by upstream commit b2e6c60d94. This removal occurred before TuxCare onboarded version 6.2.8. The target repository contains no RMI remoting code, no ContextPropagatingRemoteInvocation cla...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 does not affect Spring Security 6.2.8. The vulnerable code (ContextPropagatingRemoteInvocation.java and the entire remoting/rmi module) was completely removed from Spring Security in October 2021 by upstream commit b2e6c60d94. This removal occurred before TuxCare onboarded version 6.2.8. The target repository contains no RMI remoting code, no ContextPropagatingRemoteInvocation cla..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 6.2.8. The fix (SEC-2056) was already included in the upstream 6.2.8 release. The DaoAuthenticationProvider contains timing attack mitigation: when UsernameNotFoundException occurs, mitigateAgainstTimingAttack() performs password encoding/matching using a dummy password (userNotFoundEncodedPassword) to equalize response...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 6.2.8. The fix (SEC-2056) was already included in the upstream 6.2.8 release. The DaoAuthenticationProvider contains timing attack mitigation: when UsernameNotFoundException occurs, mitigateAgainstTimingAttack() performs password encoding/matching using a dummy password (userNotFoundEncodedPassword) to equalize response..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2014-3527 is not present in Spring Security 6.2.8. The vulnerability allowed attackers to control the service URL used for CAS proxy ticket authentication by manipulating HTTP Host headers. The fix (commit 934937d9c1dc20c396b96c08310b72cfa627acbf by upstream author Rob Winch) was already included in the upstream Spring Security 6.2.8 release before TuxCare onboarded it. The patched code uses pre-configured trusted service identifiers instead of HttpServletRequest data for building authentication URLs, blocking the attack vector.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 is not present in Spring Security 6.2.8. The vulnerability allowed attackers to control the service URL used for CAS proxy ticket authentication by manipulating HTTP Host headers. The fix (commit 934937d9c1dc20c396b96c08310b72cfa627acbf by upstream author Rob Winch) was already included in the upstream Spring Security 6.2.8 release before TuxCare onboarded it. The patched code uses pre-configured trusted service identifiers instead of HttpServletRequest data for building authentication URLs, blocking the attack vector."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 6.2.8 already contains the upstream fixes for CVE-2016-5007. The vulnerability affected versions 3.2.x, 4.0.x, and 4.1.0 due to URL pattern matching discrepancies between Spring Security and Spring MVC that allowed authorization bypass. Version 6.2.8 includes both fixes: (1) MvcRequestMatcher for harmonized pattern matching with Spring MVC, and (2) DefaultHttpFirewall blocking of URL-encoded slashes (%2f/%2F). Both fixes were authored by upstream maintainer Rob Winch and shipped in the upstream Spring Security 6.2.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 6.2.8 already contains the upstream fixes for CVE-2016-5007. The vulnerability affected versions 3.2.x, 4.0.x, and 4.1.0 due to URL pattern matching discrepancies between Spring Security and Spring MVC that allowed authorization bypass. Version 6.2.8 includes both fixes: (1) MvcRequestMatcher for harmonized pattern matching with Spring MVC, and (2) DefaultHttpFirewall blocking of URL-encoded slashes (%2f/%2F). Both fixes were authored by upstream maintainer Rob Winch and shipped in the upstream Spring Security 6.2.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 6.2.8 is not affected by CVE-2016-9879. The vulnerability (bypass of security constraints via URL-encoded slash in path parameters) was fixed in upstream Spring Security commit 666e356ebc4 by Rob Winch in December 2016. This fix was already present in the upstream Spring Security 6.2.8 release that TuxCare onboarded. The DefaultHttpFirewall class contains the containsInvalidUrlEncodedSlash() method that rejects requests with %2f or %2F by default, preventing the attack described in the CVE. The defense is active by default and cannot be bypassed without explicit configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Spring Security 6.2.8 is not affected by CVE-2016-9879. The vulnerability (bypass of security constraints via URL-encoded slash in path parameters) was fixed in upstream Spring Security commit 666e356ebc4 by Rob Winch in December 2016. This fix was already present in the upstream Spring Security 6.2.8 release that TuxCare onboarded. The DefaultHttpFirewall class contains the containsInvalidUrlEncodedSlash() method that rejects requests with %2f or %2F by default, preventing the attack described in the CVE. The defense is active by default and cannot be bypassed without explicit configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 6.2.8 is not affected by CVE-2017-4995. The vulnerability affected Spring Security 4.2.0-4.2.2 and 5.0.0.M1, involving unsafe Jackson deserialization with default typing that allowed arbitrary code execution through deserialization gadgets. The fix (commit 5dee8534cd) was authored by Rob Winch from upstream Spring Security and was already present in the Spring Security 6.2.8 release before TuxCare onboarded it. The current codebase contains the AllowlistTypeIdResolver defense that validates all classes before deserialization, rejecting any class not in the allowlist, lacking explicit mixins, or without Jackson annotations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 6.2.8 is not affected by CVE-2017-4995. The vulnerability affected Spring Security 4.2.0-4.2.2 and 5.0.0.M1, involving unsafe Jackson deserialization with default typing that allowed arbitrary code execution through deserialization gadgets. The fix (commit 5dee8534cd) was authored by Rob Winch from upstream Spring Security and was already present in the Spring Security 6.2.8 release before TuxCare onboarded it. The current codebase contains the AllowlistTypeIdResolver defense that validates all classes before deserialization, rejecting any class not in the allowlist, lacking explicit mixins, or without Jackson annotations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199: Spring Security 6.2.8-tuxcare.6 is NOT AFFECTED. The vulnerability (URL path parameter injection via semicolons to bypass security constraints) was fixed by upstream Spring Security in version 5.0.1 (commit 0eef5b4b). The fix introduced StrictHttpFirewall, which rejects requests containing semicolons (`;`, `%3b`, `%3B`) and other malicious encodings BEFORE they reach security con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199: Spring Security 6.2.8-tuxcare.6 is NOT AFFECTED. The vulnerability (URL path parameter injection via semicolons to bypass security constraints) was fixed by upstream Spring Security in version 5.0.1 (commit 0eef5b4b). The fix introduced StrictHttpFirewall, which rejects requests containing semicolons (`;`, `%3b`, `%3B`) and other malicious encodings BEFORE they reach security con..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. The target Spring Security 6.2.8-tuxcare.6 is not vulnerable to CVE-2018-15801. This CVE affects versions 5.1.x prior to 5.1.2 and involves an authorization bypass during JWT issuer validation when URL object equality was used instead of string comparison. The target version includes the fix that was applied in upstream Spring Security between 2018-2020, which ensures issuer validation uses string comparison. The fix is implemented through MappedJwtClaimSetConverter.convertIssuer() converting issuer claims to strings (using URL.toExternalForm() when needed) and JwtIssuerValidator using string equality via .toString() for comparison. This fix was already present in the upstream 6.2.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "The target Spring Security 6.2.8-tuxcare.6 is not vulnerable to CVE-2018-15801. This CVE affects versions 5.1.x prior to 5.1.2 and involves an authorization bypass during JWT issuer validation when URL object equality was used instead of string comparison. The target version includes the fix that was applied in upstream Spring Security between 2018-2020, which ensures issuer validation uses string comparison. The fix is implemented through MappedJwtClaimSetConverter.convertIssuer() converting issuer claims to strings (using URL.toExternalForm() when needed) and JwtIssuerValidator using string equality via .toString() for comparison. This fix was already present in the upstream 6.2.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 6.2.8 does not contain the vulnerable PlaintextPasswordEncoder class. The class was removed from the upstream codebase in commit 12dbf2e961 (October 2017) by upstream maintainer Rob Winch, years before TuxCare onboarded the project (March 2025). CVE-2019-11272 describes a vulnerability where PlaintextPasswordEncoder.isPasswordValid() would convert a null stored password to the string \"null\" via concatenation (encPass + \"\"), allowing authentication with password \"null\". This code path does not exist in version 6.2.8. The vulnerability was fixed in older maintenance branches (4.2.x, 3.2.x, 1.0.x) that still had the class, but the main development line removed it entirely before Spring Security 5.0. The replacement NoOpPasswordEncoder uses a different API signature (matches() instead of isPasswordValid()) and does not perform string concatenation that would convert null to \"null\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 6.2.8 does not contain the vulnerable PlaintextPasswordEncoder class. The class was removed from the upstream codebase in commit 12dbf2e961 (October 2017) by upstream maintainer Rob Winch, years before TuxCare onboarded the project (March 2025). CVE-2019-11272 describes a vulnerability where PlaintextPasswordEncoder.isPasswordValid() would convert a null stored password to the string \"null\" via concatenation (encPass + \"\"), allowing authentication with password \"null\". This code path does not exist in version 6.2.8. The vulnerability was fixed in older maintenance branches (4.2.x, 3.2.x, 1.0.x) that still had the class, but the main development line removed it entirely before Spring Security 5.0. The replacement NoOpPasswordEncoder uses a different API signature (matches() instead of isPasswordValid()) and does not perform string concatenation that would convert null to \"null\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 is not present in spring-security 6.2.8. The insecure randomness vulnerability in SecureRandomFactoryBean#setSeed was fixed by upstream Spring Security in March 2019 (commit 9c1eac79e2) by Josh Cummings. The fix ensures nextBytes() is called before setSeed(), preventing user-provided seeds from replacing the entire internal state. This fix was already included in the upstream 6.2....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 is not present in spring-security 6.2.8. The insecure randomness vulnerability in SecureRandomFactoryBean#setSeed was fixed by upstream Spring Security in March 2019 (commit 9c1eac79e2) by Josh Cummings. The fix ensures nextBytes() is called before setSeed(), preventing user-provided seeds from replacing the entire internal state. This fix was already included in the upstream 6.2...."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 affects Spring Security's queryableText() encryptor which used a fixed null initialization vector with CBC mode, enabling dictionary attacks. The target version 6.2.8 is NOT AFFECTED because the vulnerable queryableText() method was completely removed by upstream Spring Security in commit d996c2a2c6 (Sep 7, 2022) before TuxCare onboarded this version. The underlying two-parameter ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects Spring Security's queryableText() encryptor which used a fixed null initialization vector with CBC mode, enabling dictionary attacks. The target version 6.2.8 is NOT AFFECTED because the vulnerable queryableText() method was completely removed by upstream Spring Security in commit d996c2a2c6 (Sep 7, 2022) before TuxCare onboarded this version. The underlying two-parameter ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2021-22119 affects Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10, and 5.2.x prior to 5.2.11. The target version 6.2.8 is not affected. The vulnerable pattern (Map-based accumulation of OAuth2 authorization requests in session storage) is not present. The fix was already included in the upstream Spring Security 6.2.8 release that TuxCare onboarded. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and reactive (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store only ONE authorization request per session by directly setting the session attribute, overwriting any previous request. This prevents the DoS attack vector of unbounded memory consumption.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 affects Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10, and 5.2.x prior to 5.2.11. The target version 6.2.8 is not affected. The vulnerable pattern (Map-based accumulation of OAuth2 authorization requests in session storage) is not present. The fix was already included in the upstream Spring Security 6.2.8 release that TuxCare onboarded. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and reactive (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store only ONE authorization request per session by directly setting the session attribute, overwriting any previous request. This prevents the DoS attack vector of unbounded memory consumption.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2022-22976. The vulnerability (integer overflow in BCrypt when log_rounds=31 causing zero salt rounds) was fixed in the upstream Spring Security release. The fix changes rounds calculation from int (1 << log_rounds) to long (1L << log_rounds), preventing the overflow that caused the loop to skip execution. This fix was already present in the upstream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2022-22976. The vulnerability (integer overflow in BCrypt when log_rounds=31 causing zero salt rounds) was fixed in the upstream Spring Security release. The fix changes rounds calculation from int (1 << log_rounds) to long (1L << log_rounds), preventing the overflow that caused the loop to skip execution. This fix was already present in the upstream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. The target repository (Spring Security 6.2.8) is NOT affected by CVE-2022-22978. The vulnerability involves RegexRequestMatcher's default regex pattern flags allowing authorization bypass via newline characters in request paths. The fix (adding Pattern.DOTALL flag by default) was already present in upstream release 6.2.8 before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0) does not exist in the target; instead, the fixed pattern (DEFAULT = Pattern.DOTALL) is present at line 46 of RegexRequestMatcher.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "The target repository (Spring Security 6.2.8) is NOT affected by CVE-2022-22978. The vulnerability involves RegexRequestMatcher's default regex pattern flags allowing authorization bypass via newline characters in request paths. The fix (adding Pattern.DOTALL flag by default) was already present in upstream release 6.2.8 before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0) does not exist in the target; instead, the fixed pattern (DEFAULT = Pattern.DOTALL) is present at line 46 of RegexRequestMatcher.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2022-31692 affects Spring Security versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9, where AuthorizationFilter incorrectly extended OncePerRequestFilter, causing authorization bypass on FORWARD/INCLUDE dispatcher types. The target repository (Spring Security 6.2.8-tuxcare.7) contains the upstream fix (commit 1f481aafff) which changed the base class from OncePerRequestFilter to GenericFilterBean and implemented explicit dispatcher type handling. This fix was already present in the upstream Spring Security 6.2.8 release (committed 2022-10-26) before TuxCare onboarded the project (commit 41f9a577a8 \"Onboard version 6.2.8\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 affects Spring Security versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9, where AuthorizationFilter incorrectly extended OncePerRequestFilter, causing authorization bypass on FORWARD/INCLUDE dispatcher types. The target repository (Spring Security 6.2.8-tuxcare.7) contains the upstream fix (commit 1f481aafff) which changed the base class from OncePerRequestFilter to GenericFilterBean and implemented explicit dispatcher type handling. This fix was already present in the upstream Spring Security 6.2.8 release (committed 2022-10-26) before TuxCare onboarded the project (commit 41f9a577a8 \"Onboard version 6.2.8\"). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is NOT vulnerable to CVE-2023-20862. The vulnerability (logout not properly cleaning security context in serialized versions) has been fixed by upstream patches that were already present in the 6.2.8 release before TuxCare onboarded it. Both critical fix components are present: (1) SecurityContextLogoutHandler explicitly saves an empty SecurityContext to the repo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is NOT vulnerable to CVE-2023-20862. The vulnerability (logout not properly cleaning security context in serialized versions) has been fixed by upstream patches that were already present in the 6.2.8 release before TuxCare onboarded it. Both critical fix components are present: (1) SecurityContextLogoutHandler explicitly saves an empty SecurityContext to the repo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 6.2.8-tuxcare.6 is NOT affected by CVE-2024-22234. The vulnerability (null authentication treated as fully authenticated) was fixed in upstream Spring Security 6.2.8 via commit 750cb30ce4, which added explicit null checking to AuthenticationTrustResolver.isAuthenticated() and refactored isFullyAuthenticated() to use it. This upstream fix was already present when TuxCare onboarded version 6.2.8 (commit 41f9a577a8 by evasilev@cloudlinux.com). All code paths in the target use the fixed interface methods with proper null handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "impact_statement": "Spring Security 6.2.8-tuxcare.6 is NOT affected by CVE-2024-22234. The vulnerability (null authentication treated as fully authenticated) was fixed in upstream Spring Security 6.2.8 via commit 750cb30ce4, which added explicit null checking to AuthenticationTrustResolver.isAuthenticated() and refactored isFullyAuthenticated() to use it. This upstream fix was already present when TuxCare onboarded version 6.2.8 (commit 41f9a577a8 by evasilev@cloudlinux.com). All code paths in the target use the fixed interface methods with proper null handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:00.057265+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.2.3, and version 6.2.8 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 6.2.3), CVE record (last affected 6.2.2), Snyk (fixed in 6.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.2.3, and version 6.2.8 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 6.2.3), CVE record (last affected 6.2.2), Snyk (fixed in 6.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation feature, which was introduced in Spring Security 6.3.0. Version 6.2.8 predates this feature entirely\u2014the annotation, its enforcement mechanism (AuthorizeReturnObjectMethodInterceptor), and all related code do not exist in this version. Without the feature, the vulnerability ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation feature, which was introduced in Spring Security 6.3.0. Version 6.2.8 predates this feature entirely\u2014the annotation, its enforcement mechanism (AuthorizeReturnObjectMethodInterceptor), and all related code do not exist in this version. Without the feature, the vulnerability ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38827 affects Spring Security versions that use locale-dependent String.toLowerCase() and String.toUpperCase() in authorization/authentication code, potentially causing authorization bypass. The target repository spring-security 6.2.8 is NOT AFFECTED because the fix (commit a8c4d6ceada54d150ab21b6489b5c9d1c657b889 by upstream author Joe Grandja) was included in the upstream Spring Secu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38827 affects Spring Security versions that use locale-dependent String.toLowerCase() and String.toUpperCase() in authorization/authentication code, potentially causing authorization bypass. The target repository spring-security 6.2.8 is NOT AFFECTED because the fix (commit a8c4d6ceada54d150ab21b6489b5c9d1c657b889 by upstream author Joe Grandja) was included in the upstream Spring Secu..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:05:07.257149+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "action_statement": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s..."
    }
  ]
}