{
  "@id": "urn:uuid:6fbae800-3d19-4b31-b711-b33ffff789e2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:43:00.057265+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.9 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (e.g., /admin.html;x=user.html) to URLs, exploiting inconsistent servlet container handling of semicolon-delimited parameters in request paths. The fix (HttpFirewall with RequestWrapper that strips path parameters) was introduced by upstream Spring...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.9 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (e.g., /admin.html;x=user.html) to URLs, exploiting inconsistent servlet container handling of semicolon-delimited parameters in request paths. The fix (HttpFirewall with RequestWrapper that strips path parameters) was introduced by upstream Spring..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.9-tuxcare.2 is NOT affected by CVE-2011-2731 (RunAsManager race condition). Both required fixes (SEC-1750 and SEC-1967) were already present in the upstream Spring Security 6.3.9 release before TuxCare onboarding. The vulnerable code pattern - storing RunAs authentication in a shared SecurityContext without proper isolation - is not present in the target. The code creates a ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.9-tuxcare.2 is NOT affected by CVE-2011-2731 (RunAsManager race condition). Both required fixes (SEC-1750 and SEC-1967) were already present in the upstream Spring Security 6.3.9 release before TuxCare onboarding. The vulnerable code pattern - storing RunAs authentication in a shared SecurityContext without proper isolation - is not present in the target. The code creates a ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 is a CRLF injection vulnerability in Spring Security's logout functionality affecting versions before 2.0.7 and 3.0.x before 3.0.6. The target repository (Spring Security 6.3.9) is NOT AFFECTED because the upstream vendor fix is already present. The FirewalledResponse class validates all redirect locations and rejects any containing CR or LF characters before processing redirects,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 is a CRLF injection vulnerability in Spring Security's logout functionality affecting versions before 2.0.7 and 3.0.x before 3.0.6. The target repository (Spring Security 6.3.9) is NOT AFFECTED because the upstream vendor fix is already present. The FirewalledResponse class validates all redirect locations and rejects any containing CR or LF characters before processing redirects,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.9 is NOT AFFECTED by CVE-2011-2894. The vulnerable component (ContextPropagatingRemoteInvocation class in the remoting module) was completely removed from Spring Security in version 5.6.0 (commit b2e6c60d94, October 2021) by upstream maintainer Marcus Da Coregio. This removal predates TuxCare's onboarding of version 6.3.9 in September 2026. The entire org.springframework.sec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.9 is NOT AFFECTED by CVE-2011-2894. The vulnerable component (ContextPropagatingRemoteInvocation class in the remoting module) was completely removed from Spring Security in version 5.6.0 (commit b2e6c60d94, October 2021) by upstream maintainer Marcus Da Coregio. This removal predates TuxCare's onboarding of version 6.3.9 in September 2026. The entire org.springframework.sec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 (SEC-2056) is NOT present in the target. The timing attack vulnerability in DaoAuthenticationProvider was fixed by upstream Spring Security commit c076f0f2e1 (authored by rwinch@vmware.com, 2012-09-21), which was already included in Spring Security 6.3.9 when TuxCare onboarded it. The target implements the mitigation at lines 144-155, performing password validation against a dummy...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (SEC-2056) is NOT present in the target. The timing attack vulnerability in DaoAuthenticationProvider was fixed by upstream Spring Security commit c076f0f2e1 (authored by rwinch@vmware.com, 2012-09-21), which was already included in Spring Security 6.3.9 when TuxCare onboarded it. The target implements the mitigation at lines 144-155, performing password validation against a dummy..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. The target Spring Security 6.3.9 is NOT affected by CVE-2014-3527. The vulnerability (CAS proxy ticket authentication bypass via Host header injection) is not present because the upstream fix was already included in the Spring Security 6.3.9 release before TuxCare onboarded it. The vulnerable code pattern (using HttpServletRequest headers to build the CAS service URL) has been replaced with the secure pattern (using the pre-configured service URL from ServiceProperties).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target Spring Security 6.3.9 is NOT affected by CVE-2014-3527. The vulnerability (CAS proxy ticket authentication bypass via Host header injection) is not present because the upstream fix was already included in the Spring Security 6.3.9 release before TuxCare onboarded it. The vulnerable code pattern (using HttpServletRequest headers to build the CAS service URL) has been replaced with the secure pattern (using the pre-configured service URL from ServiceProperties)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.3.9 is not affected by CVE-2016-5007. Both vendor fixes are already present in the upstream release: (1) DefaultHttpFirewall blocks URL-encoded slashes (%2f/%2F) to prevent authorization bypass via path manipulation, and (2) MvcRequestMatcher ensures Spring Security uses Spring MVC's URL pattern matching logic to prevent mismatches between security rules and controller mappings. These fixes were implemented in Spring Security 4.x versions (2016) and have been carried forward through all subsequent releases including 6.3.9. The TuxCare onboarding commit imported the already-fixed upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 6.3.9 is not affected by CVE-2016-5007. Both vendor fixes are already present in the upstream release: (1) DefaultHttpFirewall blocks URL-encoded slashes (%2f/%2F) to prevent authorization bypass via path manipulation, and (2) MvcRequestMatcher ensures Spring Security uses Spring MVC's URL pattern matching logic to prevent mismatches between security rules and controller mappings. These fixes were implemented in Spring Security 4.x versions (2016) and have been carried forward through all subsequent releases including 6.3.9. The TuxCare onboarding commit imported the already-fixed upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.3.9 is not affected by CVE-2016-9879. The vulnerability allowed attackers to bypass security constraints by including URL-encoded slash characters (%2f or %2F) in request URIs, exploiting servlet container differences in path parameter handling. The fix, which adds validation to reject requests containing encoded slashes, was implemented by upstream Spring Security maintainer Rob Winch in December 2016 (commit 666e356ebc). This fix was already present in the upstream Spring Security 6.3.9 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Spring Security 6.3.9 is not affected by CVE-2016-9879. The vulnerability allowed attackers to bypass security constraints by including URL-encoded slash characters (%2f or %2F) in request URIs, exploiting servlet container differences in path parameter handling. The fix, which adds validation to reject requests containing encoded slashes, was implemented by upstream Spring Security maintainer Rob Winch in December 2016 (commit 666e356ebc). This fix was already present in the upstream Spring Security 6.3.9 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.3.9 is not affected by CVE-2017-4995. The vulnerability affected versions 4.2.0-4.2.2 and 5.0.0.M1, where SecurityJackson2Modules enabled unrestricted default typing allowing arbitrary deserialization gadgets. The upstream fix (commit 947d11f433, May 2017) replaced unrestricted typing with allowlist-based validation via AllowlistTypeIdResolver. This fix was already present in the upstream 6.3.9 release that TuxCare onboarded. The target code at SecurityJackson2Modules.java:123 uses mapper.setDefaultTyping(createAllowlistedDefaultTyping()), and lines 228-313 implement the AllowlistTypeIdResolver that validates all deserialized class names against an allowlist, throwing IllegalArgumentException for non-whitelisted classes without Jackson annotations or explicit mixins. The vulnerable pattern (unrestricted enableDefaultTyping) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 6.3.9 is not affected by CVE-2017-4995. The vulnerability affected versions 4.2.0-4.2.2 and 5.0.0.M1, where SecurityJackson2Modules enabled unrestricted default typing allowing arbitrary deserialization gadgets. The upstream fix (commit 947d11f433, May 2017) replaced unrestricted typing with allowlist-based validation via AllowlistTypeIdResolver. This fix was already present in the upstream 6.3.9 release that TuxCare onboarded. The target code at SecurityJackson2Modules.java:123 uses mapper.setDefaultTyping(createAllowlistedDefaultTyping()), and lines 228-313 implement the AllowlistTypeIdResolver that validates all deserialized class names against an allowlist, throwing IllegalArgumentException for non-whitelisted classes without Jackson annotations or explicit mixins. The vulnerable pattern (unrestricted enableDefaultTyping) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 6.3.9-tuxcare.2) is NOT AFFECTED by CVE-2018-1199. The vulnerability, which allowed attackers to bypass security constraints using path parameters with special encodings (e.g., semicolons and URL-encoded slashes like /path;%2f), was fixed in upstream Spring Security 5.0.1 (October 2017) via commit 0eef5b4b. This fix introduced StrictHttpFirewall, which rej...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 6.3.9-tuxcare.2) is NOT AFFECTED by CVE-2018-1199. The vulnerability, which allowed attackers to bypass security constraints using path parameters with special encodings (e.g., semicolons and URL-encoded slashes like /path;%2f), was fixed in upstream Spring Security 5.0.1 (October 2017) via commit 0eef5b4b. This fix introduced StrictHttpFirewall, which rej..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2018-15801 is NOT present in Spring Security 6.3.9-tuxcare.2. The vulnerability involved using Java's URL.equals() method for JWT issuer validation, which can be exploited due to DNS resolution behavior. The upstream vendor (Spring Security) fixed this in commit 19649db9ce (authored by Josh Cummings) by converting to string-based comparison. This fix was already present in the upstream 6.3.9 release that TuxCare onboarded. The current code uses JwtClaimValidator with a Predicate that performs safe string comparison (issuer.equals(claimValue.toString())), completely avoiding the vulnerable URL.equals() pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 is NOT present in Spring Security 6.3.9-tuxcare.2. The vulnerability involved using Java's URL.equals() method for JWT issuer validation, which can be exploited due to DNS resolution behavior. The upstream vendor (Spring Security) fixed this in commit 19649db9ce (authored by Josh Cummings) by converting to string-based comparison. This fix was already present in the upstream 6.3.9 release that TuxCare onboarded. The current code uses JwtClaimValidator with a Predicate that performs safe string comparison (issuer.equals(claimValue.toString())), completely avoiding the vulnerable URL.equals() pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security version 6.3.9 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security before version 5.0.0 (commit 12dbf2e961 on Oct 23, 2017 by upstream author Rob Winch). Version 6.3.9 does not contain this class at all, and the replacement NoOpPasswordEncoder does not exhibit the same vulnerability pattern. The removal was part of the upstream release that TuxCare onboarded, not a TuxCare-specific fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security version 6.3.9 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security before version 5.0.0 (commit 12dbf2e961 on Oct 23, 2017 by upstream author Rob Winch). Version 6.3.9 does not contain this class at all, and the replacement NoOpPasswordEncoder does not exhibit the same vulnerability pattern. The removal was part of the upstream release that TuxCare onboarded, not a TuxCare-specific fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.3.9 is not affected by CVE-2019-3795. The vulnerable code pattern (calling setSeed before nextBytes, allowing a user-provided seed to completely replace SecureRandom's internal state) was fixed in upstream Spring Security 5.2.0 (March 2019) and is not present in this version. The fix ensures that nextBytes(1 byte) is called before setSeed(), so the user-provided see...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.3.9 is not affected by CVE-2019-3795. The vulnerable code pattern (calling setSeed before nextBytes, allowing a user-provided seed to completely replace SecureRandom's internal state) was fixed in upstream Spring Security 5.2.0 (March 2019) and is not present in this version. The fix ensures that nextBytes(1 byte) is called before setSeed(), so the user-provided see..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 is NOT present in Spring Security 6.3.9. The vulnerable `Encryptors.queryableText()` method that used a fixed null initialization vector with CBC mode has been completely removed from the codebase. The removal was performed by upstream commit d996c2a2c6 (authored by Rob Winch) on 2022-09-07, which was already present in the upstream Spring Security 6.3.9 release before TuxCare onb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 is NOT present in Spring Security 6.3.9. The vulnerable `Encryptors.queryableText()` method that used a fixed null initialization vector with CBC mode has been completely removed from the codebase. The removal was performed by upstream commit d996c2a2c6 (authored by Rob Winch) on 2022-09-07, which was already present in the upstream Spring Security 6.3.9 release before TuxCare onb..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2021-22119: Spring Security 6.3.9-tuxcare.2 is NOT AFFECTED. The vulnerability (unbounded accumulation of OAuth2 authorization requests in session storage leading to DoS) does not exist in the target. The fix was already present in the upstream Spring Security 6.3.9 release when TuxCare onboarded it. The target stores exactly ONE authorization request per session (no Map-based accumulation), preventing resource exhaustion. Both HttpSession (Servlet/Web) and WebSession (WebFlux/Reactive) implementations contain the upstream fix authored by Craig Andrews (commit 35f5ebdbcf). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119: Spring Security 6.3.9-tuxcare.2 is NOT AFFECTED. The vulnerability (unbounded accumulation of OAuth2 authorization requests in session storage leading to DoS) does not exist in the target. The fix was already present in the upstream Spring Security 6.3.9 release when TuxCare onboarded it. The target stores exactly ONE authorization request per session (no Map-based accumulation), preventing resource exhaustion. Both HttpSession (Servlet/Web) and WebSession (WebFlux/Reactive) implementations contain the upstream fix authored by Craig Andrews (commit 35f5ebdbcf). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 affects BCrypt implementations with integer overflow when log_rounds=31. The target Spring Security 6.3.9 contains the upstream fix (commit e6297d3bf7d by Josh Cummings, June 2021) that converts rounds calculation to long type and validates overflow. This fix was already present in the upstream 6.3.9 release before TuxCare onboarded it. The vulnerable pattern (int rounds = 1 << l...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 affects BCrypt implementations with integer overflow when log_rounds=31. The target Spring Security 6.3.9 contains the upstream fix (commit e6297d3bf7d by Josh Cummings, June 2021) that converts rounds calculation to long type and validates overflow. This fix was already present in the upstream 6.3.9 release before TuxCare onboarded it. The vulnerable pattern (int rounds = 1 << l..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.3.9 is NOT affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher bypass via newline injection) was fixed in upstream commit 472c25b5e8 by Rob Winch, which changed `DEFAULT = 0` to `DEFAULT = Pattern.DOTALL`. This fix was already present in the upstream Spring Security 6.3.9 release when TuxCare onboarded it (first TuxCare commit: 9da422fa4f \"Onboard version 6.3.9\"). The target code correctly uses `Pattern.DOTALL` flag when compiling regex patterns, ensuring that `.` matches newline characters and preventing authorization bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "Spring Security 6.3.9 is NOT affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher bypass via newline injection) was fixed in upstream commit 472c25b5e8 by Rob Winch, which changed `DEFAULT = 0` to `DEFAULT = Pattern.DOTALL`. This fix was already present in the upstream Spring Security 6.3.9 release when TuxCare onboarded it (first TuxCare commit: 9da422fa4f \"Onboard version 6.3.9\"). The target code correctly uses `Pattern.DOTALL` flag when compiling regex patterns, ensuring that `.` matches newline characters and preventing authorization bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. The target Spring Security version 6.3.9 is not affected by CVE-2022-31692. The vulnerability concerned authorization bypass via FORWARD/INCLUDE dispatcher types when using OncePerRequestFilter. The fix (commit 1f481aafff14f324ffe2b43a973d3d5f54ae92d4, dated 2022-10-26) changed AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean, enabling proper handling of all dispatcher types. This fix was first released in Spring Security 5.6.9 and 5.7.5, and was already present in the upstream 6.3.9 release that TuxCare onboarded. The fix was authored by upstream Spring Security developers (marcusdacoregio@gmail.com), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "The target Spring Security version 6.3.9 is not affected by CVE-2022-31692. The vulnerability concerned authorization bypass via FORWARD/INCLUDE dispatcher types when using OncePerRequestFilter. The fix (commit 1f481aafff14f324ffe2b43a973d3d5f54ae92d4, dated 2022-10-26) changed AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean, enabling proper handling of all dispatcher types. This fix was first released in Spring Security 5.6.9 and 5.7.5, and was already present in the upstream 6.3.9 release that TuxCare onboarded. The fix was authored by upstream Spring Security developers (marcusdacoregio@gmail.com), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (spring-security 6.3.9-tuxcare.2) is NOT AFFECTED by CVE-2023-20862. Both upstream patches that fix the vulnerability (8d664bc4c2 \"DelegatingSecurityContextRepository should call loadContext\" and 2d52fb8e4b \"Clear Repository on Logout\") are present in the codebase and were shipped as part of the upstream 6.3.9 release. The vulnerable pattern - where logout fails to persist...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 The target repository (spring-security 6.3.9-tuxcare.2) is NOT AFFECTED by CVE-2023-20862. Both upstream patches that fix the vulnerability (8d664bc4c2 \"DelegatingSecurityContextRepository should call loadContext\" and 2d52fb8e4b \"Clear Repository on Logout\") are present in the codebase and were shipped as part of the upstream 6.3.9 release. The vulnerable pattern - where logout fails to persist..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. The target repository (Spring Security 6.3.9) is NOT AFFECTED by CVE-2024-22234. The vulnerability (missing null check in AuthenticationTrustResolver.isFullyAuthenticated() causing erroneous true return for null authentication) was fixed in upstream Spring Security commit 750cb30ce4 by Rob Winch on Jan 12, 2024. This fix was already present in the upstream 6.3.9 release that TuxCare onboarded on Sep 14, 2026. The fix adds a new isAuthenticated() method with explicit null checking, and updates isFullyAuthenticated() to call it. Verified in AuthenticationTrustResolver.java lines 70, 81-83 and SecurityExpressionRoot.java line 150.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "impact_statement": "The target repository (Spring Security 6.3.9) is NOT AFFECTED by CVE-2024-22234. The vulnerability (missing null check in AuthenticationTrustResolver.isFullyAuthenticated() causing erroneous true return for null authentication) was fixed in upstream Spring Security commit 750cb30ce4 by Rob Winch on Jan 12, 2024. This fix was already present in the upstream 6.3.9 release that TuxCare onboarded on Sep 14, 2026. The fix adds a new isAuthenticated() method with explicit null checking, and updates isFullyAuthenticated() to call it. Verified in AuthenticationTrustResolver.java lines 70, 81-83 and SecurityExpressionRoot.java line 150.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:00.057265+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 6.3.9 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 6.3.9 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. The upstream fix was released in 6.3.2, and version 6.3.9 is a later release of the same line. Advisories: GitHub GHSA-hmqf-wpq9-jq83 (fixed in 6.3.2), NVD (fixed in 6.3.2), CVE record (fixed in 6.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "The upstream fix was released in 6.3.2, and version 6.3.9 is a later release of the same line. Advisories: GitHub GHSA-hmqf-wpq9-jq83 (fixed in 6.3.2), NVD (fixed in 6.3.2), CVE record (fixed in 6.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.9 is NOT affected by CVE-2024-38827. The vulnerability concerns locale-dependent String.toLowerCase()/toUpperCase() calls in authorization code that could cause incorrect authorization decisions in certain locales (e.g., Turkish locale where 'i'.toUpperCase() becomes '\u0130' instead of 'I'). The upstream fix (commit a8c4d6ceada54d150ab21b6489b5c9d1c657b889 by Joe Grandja) was al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.9 is NOT affected by CVE-2024-38827. The vulnerability concerns locale-dependent String.toLowerCase()/toUpperCase() calls in authorization code that could cause incorrect authorization decisions in certain locales (e.g., Turkish locale where 'i'.toUpperCase() becomes '\u0130' instead of 'I'). The upstream fix (commit a8c4d6ceada54d150ab21b6489b5c9d1c657b889 by Joe Grandja) was al..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.9 is not affected by CVE-2025-22223. The vulnerability exists only in the custom UniqueSecurityAnnotationScanner class, which was introduced in Spring Security 6.4.0 (released November 2024). Version 6.3.9 predates this component and uses Spring Framework's built-in MergedAnnotations mechanism for method annotation scanning, which correctly handles parameterized generic type...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.9 is not affected by CVE-2025-22223. The vulnerability exists only in the custom UniqueSecurityAnnotationScanner class, which was introduced in Spring Security 6.4.0 (released November 2024). Version 6.3.9 predates this component and uses Spring Framework's built-in MergedAnnotations mechanism for method annotation scanning, which correctly handles parameterized generic type..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2025-22234 describes a timing attack vulnerability where the fix for CVE-2025-22228 (which enforced a 72-byte password length limit in BCrypt) inadvertently broke timing attack mitigation during password verification. The target version 6.3.9 is NOT affected because the upstream fix (commit c1aa99fdd2113a232986e9c3a44673ae752de840 by Joe Grandja) was already present in the upstream 6.3.9 re...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 describes a timing attack vulnerability where the fix for CVE-2025-22228 (which enforced a 72-byte password length limit in BCrypt) inadvertently broke timing attack mitigation during password verification. The target version 6.3.9 is NOT affected because the upstream fix (commit c1aa99fdd2113a232986e9c3a44673ae752de840 by Joe Grandja) was already present in the upstream 6.3.9 re..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.3.9 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.3.9 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.3.9 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 6.3.9 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target version (Spring Security 6.3.9-tuxcare.2) is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0, which postdates this version. The target version predates the feature introduction and therefore does not contain the vulnerable code path. This is a Rule 5 ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 The target version (Spring Security 6.3.9-tuxcare.2) is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0, which postdates this version. The target version predates the feature introduction and therefore does not contain the vulnerable code path. This is a Rule 5 ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.9 is NOT AFFECTED by CVE-2026-59277. The vulnerable component, the `InetAddressMatchers` utility class with `matchInternal()` and `matchExternal()` methods, does not exist in this version. This utility was introduced in a later version of Spring Security (after the June/July 2026 patches). The target has no mechanism to classify IP addresses as internal/private vs external/p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.9 is NOT AFFECTED by CVE-2026-59277. The vulnerable component, the `InetAddressMatchers` utility class with `matchInternal()` and `matchExternal()` methods, does not exist in this version. This utility was introduced in a later version of Spring Security (after the June/July 2026 patches). The target has no mechanism to classify IP addresses as internal/private vs external/p..."
    }
  ]
}