{
  "@id": "urn:uuid:17d9b168-6236-45ce-b0fc-5d855fb0a2e3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 43,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:43:20.912842+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T21:01:09.226514+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (e.g., /admin.html;x=user.html). The target (Spring Security 6.4.13) is not affected because the fix (SEC-1584) was added by Luke Taylor in October 2010 and has been part of Spring Security since version 3.1. The defense strips path parameters from s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (e.g., /admin.html;x=user.html). The target (Spring Security 6.4.13) is not affected because the fix (SEC-1584) was added by Luke Taylor in October 2010 and has been part of Spring Security since version 3.1. The defense strips path parameters from s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T19:32:16.768619+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target (version 6.4.13) contains the complete upstream fix from 2011-2012 (SEC-1750 and SEC-1967). The vulnerable pattern\u2014storing RunAs Authentication in a shared SecurityContext accessible across threads\u2014is not present. The fix creates an isolated SecurityContext per RunAs operation (AbstractSecurityInterceptor line...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target (version 6.4.13) contains the complete upstream fix from 2011-2012 (SEC-1750 and SEC-1967). The vulnerable pattern\u2014storing RunAs Authentication in a shared SecurityContext accessible across threads\u2014is not present. The fix creates an isolated SecurityContext per RunAs operation (AbstractSecurityInterceptor line..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T23:10:26.706684+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 The target (Spring Security 6.4.13) is NOT AFFECTED by CVE-2011-2732. The vulnerability pattern (CRLF injection in logout redirects) is not present because upstream Spring Security fixed this issue years ago. Both defense mechanisms from the vendor patches are present: (1) FirewalledResponse validates all redirect locations and rejects any containing CR or LF characters, and (2) targetUrlParame...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Security 6.4.13) is NOT AFFECTED by CVE-2011-2732. The vulnerability pattern (CRLF injection in logout redirects) is not present because upstream Spring Security fixed this issue years ago. Both defense mechanisms from the vendor patches are present: (1) FirewalledResponse validates all redirect locations and rejects any containing CR or LF characters, and (2) targetUrlParame..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T22:48:48.232589+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 affects Spring Security 2.0.0-2.0.6 and 3.0.0-3.0.5 via unsafe deserialization in the RMI remoting module's ContextPropagatingRemoteInvocation class. The target version 6.4.13 is not affected because the entire Spring Security remoting module (including all RMI support) was removed by upstream in October 2021 (commit b2e6c60d94, included in Spring Security 6.0.0-M1 and all subsequ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security 2.0.0-2.0.6 and 3.0.0-3.0.5 via unsafe deserialization in the RMI remoting module's ContextPropagatingRemoteInvocation class. The target version 6.4.13 is not affected because the entire Spring Security remoting module (including all RMI support) was removed by upstream in October 2021 (commit b2e6c60d94, included in Spring Security 6.0.0-M1 and all subsequ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T21:17:59.994008+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 (SEC-2056): The timing-based username enumeration vulnerability is NOT present in Spring Security 6.4.13. The fix was implemented by upstream (Rob Winch, VMware) in commit c076f0f2e1 and shipped in the upstream release that TuxCare onboarded. The target code contains complete mitigation: prepareTimingAttackProtection() ensures a dummy password is pre-encoded, and mitigateAgainstTi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (SEC-2056): The timing-based username enumeration vulnerability is NOT present in Spring Security 6.4.13. The fix was implemented by upstream (Rob Winch, VMware) in commit c076f0f2e1 and shipped in the upstream release that TuxCare onboarded. The target code contains complete mitigation: prepareTimingAttackProtection() ensures a dummy password is pre-encoded, and mitigateAgainstTi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T17:41:00.166714+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2014-3527 (SEC-2688) vulnerability is NOT present in Spring Security 6.4.13-tuxcare.7. The upstream fix (commit 934937d9c1) was already included in the Spring Security 6.4.13 release that TuxCare onboarded. The vulnerable pattern\u2014constructing CAS proxy ticket authentication service URLs from untrusted HTTP Host headers\u2014has been replaced with a secure implementation that uses configured ServiceProperties values.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 (SEC-2688) vulnerability is NOT present in Spring Security 6.4.13-tuxcare.7. The upstream fix (commit 934937d9c1) was already included in the Spring Security 6.4.13 release that TuxCare onboarded. The vulnerable pattern\u2014constructing CAS proxy ticket authentication service URLs from untrusted HTTP Host headers\u2014has been replaced with a secure implementation that uses configured ServiceProperties values."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:57.157354+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2016-5007 affects Spring Security versions 3.2.x, 4.0.x, and 4.1.0 where URL pattern matching differences between Spring Security authorization rules and Spring MVC controller mappings allow security bypass. The target (Spring Security 6.4.13-tuxcare) is NOT AFFECTED because both required fixes were already present in the upstream 6.4.13 release: (1) MvcRequestMatcher for consistent URL matching using HandlerMappingIntrospector, and (2) URL-encoded slash blocking in DefaultHttpFirewall. Both fixes were authored by upstream (Rob Winch, rwinch@gopivotal.com) in 2016 and shipped with Spring Security 4.1.1+. TuxCare's onboarding of version 6.4.13 in 2026 inherited these fixes; no backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 affects Spring Security versions 3.2.x, 4.0.x, and 4.1.0 where URL pattern matching differences between Spring Security authorization rules and Spring MVC controller mappings allow security bypass. The target (Spring Security 6.4.13-tuxcare) is NOT AFFECTED because both required fixes were already present in the upstream 6.4.13 release: (1) MvcRequestMatcher for consistent URL matching using HandlerMappingIntrospector, and (2) URL-encoded slash blocking in DefaultHttpFirewall. Both fixes were authored by upstream (Rob Winch, rwinch@gopivotal.com) in 2016 and shipped with Spring Security 4.1.1+. TuxCare's onboarding of version 6.4.13 in 2026 inherited these fixes; no backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:11:13.395831+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. Target Spring Security 6.4.13 is NOT affected by CVE-2016-9879. The vulnerability (URL-encoded slash bypass) was fixed in the upstream release. The fix code is present at DefaultHttpFirewall.java:60-62, which detects and rejects requests containing %2f or %2F in the request URI. The fix was authored by Rob Winch (upstream) and shipped with Spring Security 6.4.13 when TuxCare onboarded it. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Target Spring Security 6.4.13 is NOT affected by CVE-2016-9879. The vulnerability (URL-encoded slash bypass) was fixed in the upstream release. The fix code is present at DefaultHttpFirewall.java:60-62, which detects and rejects requests containing %2f or %2F in the request URI. The fix was authored by Rob Winch (upstream) and shipped with Spring Security 6.4.13 when TuxCare onboarded it. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2017-4995 affects Spring Security 4.2.0-4.2.2 and 5.0.0.M1 due to unrestricted Jackson deserialization with default typing enabled. The target (Spring Security 6.4.13-tuxcare.7) contains the upstream fix (commit 5dee8534cd by Rob Winch, 2017-06-07) that adds AllowlistTypeIdResolver for class name validation during deserialization. This fix was already present in upstream release 6.4.13 when TuxCare onboarded it (2026-07-17). The vulnerable pattern (missing whitelist validation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "CVE-2017-4995 affects Spring Security 4.2.0-4.2.2 and 5.0.0.M1 due to unrestricted Jackson deserialization with default typing enabled. The target (Spring Security 6.4.13-tuxcare.7) contains the upstream fix (commit 5dee8534cd by Rob Winch, 2017-06-07) that adds AllowlistTypeIdResolver for class name validation during deserialization. This fix was already present in upstream release 6.4.13 when TuxCare onboarded it (2026-07-17). The vulnerable pattern (missing whitelist validation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:46.608372+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 6.4.13) is not affected by CVE-2018-1199. The vulnerability, which allowed attackers to bypass security constraints using URL path parameters with semicolons, has been mitigated by the upstream Spring Security team's introduction of StrictHttpFirewall. This fix was already present in version 6.4.13 when TuxCare onboarded it. The StrictHttpFirewall class re...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 6.4.13) is not affected by CVE-2018-1199. The vulnerability, which allowed attackers to bypass security constraints using URL path parameters with semicolons, has been mitigated by the upstream Spring Security team's introduction of StrictHttpFirewall. This fix was already present in version 6.4.13 when TuxCare onboarded it. The StrictHttpFirewall class re..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The vulnerability involved JWT issuer validation using Java URL object comparison, which can incorrectly match different issuers due to URL equality semantics. The target (Spring Security 6.4.13) shipped with the upstream fix already applied - the vulnerable URL comparison pattern is not present. The fix (commit 19649db9ce, November 2018) changed validation from URL object comparison to string comparison, and was included in the upstream release that TuxCare onboarded in July 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The vulnerability involved JWT issuer validation using Java URL object comparison, which can incorrectly match different issuers due to URL equality semantics. The target (Spring Security 6.4.13) shipped with the upstream fix already applied - the vulnerable URL comparison pattern is not present. The fix (commit 19649db9ce, November 2018) changed validation from URL object comparison to string comparison, and was included in the upstream release that TuxCare onboarded in July 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. The target Spring Security version 6.4.13 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security core in version 5.0 (October 2017, commit 12dbf2e961) by upstream maintainer Rob Winch. This removal predates version 6.4.13 and was part of the upstream release that TuxCare onboarded. The class does not exist in the target repository, making the vulnerability impossible to exploit. CVE-2019-11272 affects only Spring Security 4.2.x up to 4.2.12 and older unsupported versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "The target Spring Security version 6.4.13 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security core in version 5.0 (October 2017, commit 12dbf2e961) by upstream maintainer Rob Winch. This removal predates version 6.4.13 and was part of the upstream release that TuxCare onboarded. The class does not exist in the target repository, making the vulnerability impossible to exploit. CVE-2019-11272 affects only Spring Security 4.2.x up to 4.2.12 and older unsupported versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T23:56:10.637829+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.4.13 does not contain CVE-2019-3795 (insecure randomness vulnerability in SecureRandomFactoryBean). The fix was already present in the upstream Spring Security 6.4.13 release that TuxCare onboarded. The vulnerable pattern (applying custom seed before default seeding) is not present; the current implementation correctly calls nextBytes() to trigger platform seeding BEFORE apply...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.13 does not contain CVE-2019-3795 (insecure randomness vulnerability in SecureRandomFactoryBean). The fix was already present in the upstream Spring Security 6.4.13 release that TuxCare onboarded. The vulnerable pattern (applying custom seed before default seeding) is not present; the current implementation correctly calls nextBytes() to trigger platform seeding BEFORE apply..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T22:08:47.711669+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 affects Spring Security versions that use a fixed null initialization vector (IV) with CBC mode in the queryable text encryptor, enabling dictionary attacks. The target repository (Spring Security 6.4.13-tuxcare.7) is not affected because the vulnerable `queryableText()` method has been completely removed. This removal was performed by upstream maintainer Rob Winch in commit d996c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects Spring Security versions that use a fixed null initialization vector (IV) with CBC mode in the queryable text encryptor, enabling dictionary attacks. The target repository (Spring Security 6.4.13-tuxcare.7) is not affected because the vulnerable `queryableText()` method has been completely removed. This removal was performed by upstream maintainer Rob Winch in commit d996c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2021-22119 is NOT present in Spring Security 6.4.13-tuxcare.7. The vulnerability allowed DoS via unbounded accumulation of OAuth2 authorization requests in session memory. The vulnerable pattern (Map-based storage allowing multiple requests per session) is absent from the target. The fix was applied by upstream Spring Security in commit 35f5ebdbcf (April 2021) and shipped in the upstream 6.4.13 release that TuxCare onboarded in July 2026. Both HttpSessionOAuth2AuthorizationRequestRepository (Web) and WebSessionOAuth2ServerAuthorizationRequestRepository (WebFlux) store only ONE authorization request per session, preventing accumulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 is NOT present in Spring Security 6.4.13-tuxcare.7. The vulnerability allowed DoS via unbounded accumulation of OAuth2 authorization requests in session memory. The vulnerable pattern (Map-based storage allowing multiple requests per session) is absent from the target. The fix was applied by upstream Spring Security in commit 35f5ebdbcf (April 2021) and shipped in the upstream 6.4.13 release that TuxCare onboarded in July 2026. Both HttpSessionOAuth2AuthorizationRequestRepository (Web) and WebSessionOAuth2ServerAuthorizationRequestRepository (WebFlux) store only ONE authorization request per session, preventing accumulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T05:11:00.089232+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 6.4.13 is not affected by CVE-2022-22976. The integer overflow vulnerability in BCrypt's rounds calculation was fixed in the upstream Spring Security release before TuxCare onboarded version 6.4.13. The fix changes the rounds calculation from using int (which overflows at log_rounds=31) to long type, preventing the overflow that would cause zero salt rounds. The vulnerabl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 6.4.13 is not affected by CVE-2022-22976. The integer overflow vulnerability in BCrypt's rounds calculation was fixed in the upstream Spring Security release before TuxCare onboarded version 6.4.13. The fix changes the rounds calculation from using int (which overflows at log_rounds=31) to long type, preventing the overflow that would cause zero salt rounds. The vulnerabl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2022-22978 is not present in Spring Security 6.4.13. The vulnerability involved RegexRequestMatcher's pattern matching bypassed by paths containing newline characters (\\n, \\r) because the regex `.` metacharacter didn't match line separators by default. The upstream fix (commit c6461d61ba, May 2022) changed DEFAULT from 0 to Pattern.DOTALL, making `.` match all characters including newlines. This fix was already included in the Spring Security 6.4.13 upstream release that TuxCare onboarded. The target repository at SHA 6c83e2d405 contains the fixed code with Pattern.DOTALL set as the default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 is not present in Spring Security 6.4.13. The vulnerability involved RegexRequestMatcher's pattern matching bypassed by paths containing newline characters (\\n, \\r) because the regex `.` metacharacter didn't match line separators by default. The upstream fix (commit c6461d61ba, May 2022) changed DEFAULT from 0 to Pattern.DOTALL, making `.` match all characters including newlines. This fix was already included in the Spring Security 6.4.13 upstream release that TuxCare onboarded. The target repository at SHA 6c83e2d405 contains the fixed code with Pattern.DOTALL set as the default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. The target repository (Spring Security 6.4.13) is NOT affected by CVE-2022-31692. The vulnerability was fixed in upstream Spring Security by commit 1f481aafff (October 2022), which changed AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean and added explicit dispatcher type handling. This fix was already present in the Spring Security 6.4.13 release that TuxCare onboarded. The current code extends GenericFilterBean (line 52), implements explicit dispatcher type controls (lines 108-114), and uses even more secure defaults than the original patch (observeOncePerRequest=false, filterErrorDispatch=true, filterAsyncDispatch=true), ensuring authorization checks are applied to all dispatcher types including FORWARD and INCLUDE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "The target repository (Spring Security 6.4.13) is NOT affected by CVE-2022-31692. The vulnerability was fixed in upstream Spring Security by commit 1f481aafff (October 2022), which changed AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean and added explicit dispatcher type handling. This fix was already present in the Spring Security 6.4.13 release that TuxCare onboarded. The current code extends GenericFilterBean (line 52), implements explicit dispatcher type controls (lines 108-114), and uses even more secure defaults than the original patch (observeOncePerRequest=false, filterErrorDispatch=true, filterAsyncDispatch=true), ensuring authorization checks are applied to all dispatcher types including FORWARD and INCLUDE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T22:45:14.636645+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 is NOT present in Spring Security 6.4.13. The vulnerability affects versions 5.7.x prior to 5.7.8, 5.8.x prior to 5.8.3, and 6.0.x prior to 6.0.3. The target version (6.4.13) is well beyond the affected range. The fix was applied by upstream Spring Security maintainer Marcus Da Coregio in commits 2d52fb8e4bff and 8d664bc4c293 (March 2023) and shipped in version 6.0.3. TuxCare onb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 is NOT present in Spring Security 6.4.13. The vulnerability affects versions 5.7.x prior to 5.7.8, 5.8.x prior to 5.8.3, and 6.0.x prior to 6.0.3. The target version (6.4.13) is well beyond the affected range. The fix was applied by upstream Spring Security maintainer Marcus Da Coregio in commits 2d52fb8e4bff and 8d664bc4c293 (March 2023) and shipped in version 6.0.3. TuxCare onb..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. The target repository (Spring Security 6.4.13-tuxcare.7) is NOT vulnerable to CVE-2024-22234. The upstream fix was already included in Spring Security 6.4.13 release, which TuxCare onboarded. The vulnerable pattern where isFullyAuthenticated(null) returns true has been eliminated by the addition of the isAuthenticated() method with explicit null validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "impact_statement": "The target repository (Spring Security 6.4.13-tuxcare.7) is NOT vulnerable to CVE-2024-22234. The upstream fix was already included in Spring Security 6.4.13 release, which TuxCare onboarded. The vulnerable pattern where isFullyAuthenticated(null) returns true has been eliminated by the addition of the isAuthenticated() method with explicit null validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:20.912842+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 6.4.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 6.4.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:51:09.392901+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38810 affects Spring Security 6.3.0 and 6.3.1 where @AuthorizeReturnObject annotation could allow duplicate AuthorizationAdvisor creation, rendering security annotations ineffective. The target version 6.4.13 contains the upstream fix (commit ae8e4d148e) that was applied in Spring Security 6.3.2. This fix introduces AdvisorWrapper to ensure exactly one advisor per annotation. The fix w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38810 affects Spring Security 6.3.0 and 6.3.1 where @AuthorizeReturnObject annotation could allow duplicate AuthorizationAdvisor creation, rendering security annotations ineffective. The target version 6.4.13 contains the upstream fix (commit ae8e4d148e) that was applied in Spring Security 6.3.2. This fix introduces AdvisorWrapper to ensure exactly one advisor per annotation. The fix w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T20:02:15.054048+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38827 is NOT present in spring-security 6.4.13. The vulnerability (locale-dependent String case conversion in authorization code) was fixed upstream by commit a7bf8f7cc6 on October 28, 2024, and this fix was already included in the upstream Spring Security 6.4.13 release that TuxCare onboarded. All authorization-critical code now uses Locale.ROOT or Locale.ENGLISH for case conversion, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38827 is NOT present in spring-security 6.4.13. The vulnerability (locale-dependent String case conversion in authorization code) was fixed upstream by commit a7bf8f7cc6 on October 28, 2024, and this fix was already included in the upstream Spring Security 6.4.13 release that TuxCare onboarded. All authorization-critical code now uses Locale.ROOT or Locale.ENGLISH for case conversion, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T02:18:37.843029+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2025-22223. The vulnerability (incorrect annotation location on parameterized types causing authorization bypass) was fixed in upstream commit dc2e1af2da by Josh Cummings on 2025-01-08. This fix shipped in the upstream 6.4.13 release that TuxCare onboarded on 2026-07-17. The target contains the complete fix at lines 215-261 of UniqueSecurityAnnotati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2025-22223. The vulnerability (incorrect annotation location on parameterized types causing authorization bypass) was fixed in upstream commit dc2e1af2da by Josh Cummings on 2025-01-08. This fix shipped in the upstream 6.4.13 release that TuxCare onboarded on 2026-07-17. The target contains the complete fix at lines 215-261 of UniqueSecurityAnnotati..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2025-22234 is NOT present in Spring Security 6.4.13. The vulnerability (broken timing attack mitigation caused by unconditional BCrypt 72-byte password limit enforcement) was fixed in upstream commit c1aa99fdd2 which shipped with Spring Security 6.4.13. The fix modified BCrypt to only enforce the 72-byte limit when encoding new passwords (!for_check), allowing password matching to proceed n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 is NOT present in Spring Security 6.4.13. The vulnerability (broken timing attack mitigation caused by unconditional BCrypt 72-byte password limit enforcement) was fixed in upstream commit c1aa99fdd2 which shipped with Spring Security 6.4.13. The fix modified BCrypt to only enforce the 72-byte limit when encoding new passwords (!for_check), allowing password matching to proceed n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T10:49:55.998641+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.4.13 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.4.13 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T11:37:35.533056+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.4.13 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 6.4.13 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22751"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T12:13:41.094671+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core, and is fixed in 6.4.13-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core, and is fixed in 6.4.13-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. Exhaustive searches confirmed the class is absent from the entire codebase, including all tracked branches and tags up to 6.5.11. The InetAddressMatchers utility class appears to have been introduced in a lat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. Exhaustive searches confirmed the class is absent from the entire codebase, including all tracked branches and tags up to 6.5.11. The InetAddressMatchers utility class appears to have been introduced in a lat..."
    }
  ]
}