{
  "@id": "urn:uuid:520308ab-f14c-4056-ae7a-b11526cd7922",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 42,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:39:00.080138+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T20:58:33.259556+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.4.3 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolons) to URLs. The fix (SEC-1584) was introduced in Spring Security 2.0.6 and 3.0.4 in October 2010 by upstream maintainer Luke Taylor. This fix is present in the upstream 6.4.3 release that TuxCare onboarded. The target implements comprehen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.3 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolons) to URLs. The fix (SEC-1584) was introduced in Spring Security 2.0.6 and 3.0.4 in October 2010 by upstream maintainer Luke Taylor. This fix is present in the upstream 6.4.3 release that TuxCare onboarded. The target implements comprehen..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T19:31:56.289601+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.4.3-tuxcare.11 is NOT affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager causing cross-thread privilege confusion via shared SecurityContext mutation) was fixed in upstream Spring Security 3.0.6 (2011) via commit 5fce0a58bd authored by luke.taylor@springsource.com. This fix shipped in the upstream 6.4.3 release that TuxCare onboarded (first...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.4.3-tuxcare.11 is NOT affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager causing cross-thread privilege confusion via shared SecurityContext mutation) was fixed in upstream Spring Security 3.0.6 (2011) via commit 5fce0a58bd authored by luke.taylor@springsource.com. This fix shipped in the upstream 6.4.3 release that TuxCare onboarded (first..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T23:06:48.799530+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 describes a CRLF injection vulnerability in Spring Security logout functionality via the spring-security-redirect parameter. The target repository (Spring Security 6.4.3) is NOT AFFECTED because the upstream vendor's fix was already present in the release that TuxCare onboarded. The fix (commit 824464516c by luke.taylor@springsource.com from 2011) added CRLF validation to Firewall...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 describes a CRLF injection vulnerability in Spring Security logout functionality via the spring-security-redirect parameter. The target repository (Spring Security 6.4.3) is NOT AFFECTED because the upstream vendor's fix was already present in the release that TuxCare onboarded. The fix (commit 824464516c by luke.taylor@springsource.com from 2011) added CRLF validation to Firewall..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T22:45:37.926257+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.4.3 is NOT affected by CVE-2011-2894. The vulnerable RMI remoting module (containing ContextPropagatingRemoteInvocation.java) was completely removed by upstream Spring Security in commit b2e6c60d94 (2021-11-01). This removal occurred before TuxCare onboarded version 6.4.3, meaning the vulnerable code never existed in this target version. The entire spring-security-remoting mod...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.3 is NOT affected by CVE-2011-2894. The vulnerable RMI remoting module (containing ContextPropagatingRemoteInvocation.java) was completely removed by upstream Spring Security in commit b2e6c60d94 (2021-11-01). This removal occurred before TuxCare onboarded version 6.4.3, meaning the vulnerable code never existed in this target version. The entire spring-security-remoting mod..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T21:15:17.463976+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 6.4.3) is not affected by CVE-2012-5055 (username enumeration via timing attack). The vulnerability was fixed in the upstream Spring Security project by commit c076f0f2e1 authored by Rob Winch (rwinch@vmware.com) from VMware. This fix was already present in Spring Security release 6.4.3 when TuxCare onboarded it (first TuxCare commit e168912832 comes 12,66...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 6.4.3) is not affected by CVE-2012-5055 (username enumeration via timing attack). The vulnerability was fixed in the upstream Spring Security project by commit c076f0f2e1 authored by Rob Winch (rwinch@vmware.com) from VMware. This fix was already present in Spring Security release 6.4.3 when TuxCare onboarded it (first TuxCare commit e168912832 comes 12,66..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T17:39:47.602520+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. CVE-2014-3527 is NOT present in Spring Security 6.4.3. The vulnerability was fixed by upstream Spring Security in 2014 (commit 934937d9c1 by Rob Winch) and shipped with the upstream 6.4.3 release that TuxCare onboarded. The fix replaces untrusted HTTP request headers (Host, port, scheme) with trusted configuration from ServiceProperties when building CAS service URLs for proxy ticket authentication, preventing malicious CAS services from impersonating other services.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 is NOT present in Spring Security 6.4.3. The vulnerability was fixed by upstream Spring Security in 2014 (commit 934937d9c1 by Rob Winch) and shipped with the upstream 6.4.3 release that TuxCare onboarded. The fix replaces untrusted HTTP request headers (Host, port, scheme) with trusted configuration from ServiceProperties when building CAS service URLs for proxy ticket authentication, preventing malicious CAS services from impersonating other services."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:33:19.742472+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. CVE-2016-5007 is NOT present in Spring Security 6.4.3. The vulnerability concerned URL pattern matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. Both primary fixes are present: (1) MvcRequestMatcher which aligns Spring Security's pattern matching with Spring MVC's matching logic via HandlerMappingIntrospector, and (2) DefaultHttpFirewall blocking of URL-encoded slashes (%2f/%2F) to prevent path confusion attacks. Both fixes were authored by upstream Spring Security maintainers (Rob Winch, Marcus Da Coregio) and shipped in the upstream Spring Security release before TuxCare's involvement. MvcRequestMatcher is used by default when Spring MVC is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Security 6.4.3. The vulnerability concerned URL pattern matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. Both primary fixes are present: (1) MvcRequestMatcher which aligns Spring Security's pattern matching with Spring MVC's matching logic via HandlerMappingIntrospector, and (2) DefaultHttpFirewall blocking of URL-encoded slashes (%2f/%2F) to prevent path confusion attacks. Both fixes were authored by upstream Spring Security maintainers (Rob Winch, Marcus Da Coregio) and shipped in the upstream Spring Security release before TuxCare's involvement. MvcRequestMatcher is used by default when Spring MVC is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. CVE-2016-9879: Target Spring Security 6.4.3 is NOT AFFECTED. The vulnerability (URL-encoded slash bypass of security constraints) was fixed by upstream Spring Security in December 2016 (commit 666e356ebc4 by Rob Winch). The fix was already present in Spring Security 6.4.3 when TuxCare onboarded this version. Both DefaultHttpFirewall and StrictHttpFirewall (the default) reject URL-encoded slashes (%2f/%2F) by default, preventing the bypass attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "CVE-2016-9879: Target Spring Security 6.4.3 is NOT AFFECTED. The vulnerability (URL-encoded slash bypass of security constraints) was fixed by upstream Spring Security in December 2016 (commit 666e356ebc4 by Rob Winch). The fix was already present in Spring Security 6.4.3 when TuxCare onboarded this version. Both DefaultHttpFirewall and StrictHttpFirewall (the default) reject URL-encoded slashes (%2f/%2F) by default, preventing the bypass attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. CVE-2017-4995 is NOT present in Spring Security 6.4.3-tuxcare.11. The vulnerability involves Jackson deserialization with default typing enabled, allowing arbitrary code execution via deserialization gadgets. The upstream vendor (Spring Security) fixed this in commit 5dee8534cd (2017-05-31) by introducing whitelist-based type validation through AllowlistTypeIdResolver. This fix was already present in the upstream release 6.4.3 before TuxCare onboarding (2026-04-07), making the target not affected. The defense code validates all type identifiers against a hardcoded whitelist, explicit mixins, or Jackson annotations before allowing deserialization, blocking the attack chain from malicious input to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "CVE-2017-4995 is NOT present in Spring Security 6.4.3-tuxcare.11. The vulnerability involves Jackson deserialization with default typing enabled, allowing arbitrary code execution via deserialization gadgets. The upstream vendor (Spring Security) fixed this in commit 5dee8534cd (2017-05-31) by introducing whitelist-based type validation through AllowlistTypeIdResolver. This fix was already present in the upstream release 6.4.3 before TuxCare onboarding (2026-04-07), making the target not affected. The defense code validates all type identifiers against a hardcoded whitelist, explicit mixins, or Jackson annotations before allowing deserialization, blocking the attack chain from malicious input to code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:24.708688+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 affects Spring Security versions 4.1.x-5.0.x where URL path parameters (semicolons) could bypass security constraints. The target (Spring Security 6.4.3-tuxcare) contains the complete upstream fix: StrictHttpFirewall is the default firewall and rejects all requests containing semicolons, encoded slashes, and other suspicious characters. The fix (commit 0eef5b4b42 by Rob Winch) was...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Security versions 4.1.x-5.0.x where URL path parameters (semicolons) could bypass security constraints. The target (Spring Security 6.4.3-tuxcare) contains the complete upstream fix: StrictHttpFirewall is the default firewall and rejects all requests containing semicolons, encoded slashes, and other suspicious characters. The fix (commit 0eef5b4b42 by Rob Winch) was..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. CVE-2018-15801 is NOT present in Spring Security 6.4.3. The vulnerability affected versions 5.1.x prior to 5.1.2 and involved URL object equality comparison in JWT issuer validation, which allowed different issuer strings to be treated as equal due to URL normalization. The fix (commit 19649db9, November 2018) changed issuer validation to use string comparison instead of URL object comparison. This fix was included in Spring Security 5.2.0.M1 and all subsequent versions, including 6.4.3. The target code uses string-based comparison via JwtClaimValidator, preventing issuer confusion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 is NOT present in Spring Security 6.4.3. The vulnerability affected versions 5.1.x prior to 5.1.2 and involved URL object equality comparison in JWT issuer validation, which allowed different issuer strings to be treated as equal due to URL normalization. The fix (commit 19649db9, November 2018) changed issuer validation to use string comparison instead of URL object comparison. This fix was included in Spring Security 5.2.0.M1 and all subsequent versions, including 6.4.3. The target code uses string-based comparison via JwtClaimValidator, preventing issuer confusion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. Spring Security version 6.4.3 is not affected by CVE-2019-11272. The vulnerable component PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0 (October 2017, commit 12dbf2e961) by upstream maintainer Rob Winch, years before version 6.4.3 was released. The target version never contained the vulnerable code and uses modern, secure password encoders (BCrypt, Argon2, Pbkdf2) that properly handle null encoded passwords.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security version 6.4.3 is not affected by CVE-2019-11272. The vulnerable component PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0 (October 2017, commit 12dbf2e961) by upstream maintainer Rob Winch, years before version 6.4.3 was released. The target version never contained the vulnerable code and uses modern, secure password encoders (BCrypt, Argon2, Pbkdf2) that properly handle null encoded passwords.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T23:56:10.637829+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 6.4.3-tuxcare) is not affected by CVE-2019-3795. The vulnerability was fixed in upstream Spring Security versions 5.1.5, 5.0.12, and 4.2.12 in March 2019. The fix commit 9c1eac79e2abb50f7b01e77c2418566f2a30532f by Josh Cummings was already present in the upstream Spring Security 6.4.3 release that TuxCare onboarded. The vulnerable pattern (calling setSeed(...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 6.4.3-tuxcare) is not affected by CVE-2019-3795. The vulnerability was fixed in upstream Spring Security versions 5.1.5, 5.0.12, and 4.2.12 in March 2019. The fix commit 9c1eac79e2abb50f7b01e77c2418566f2a30532f by Josh Cummings was already present in the upstream Spring Security 6.4.3 release that TuxCare onboarded. The vulnerable pattern (calling setSeed(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T18:39:00.080138+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 6.4.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 6.4.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T22:07:50.682094+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 6.4.3-tuxcare.11 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method was completely removed by upstream Spring Security in commit d996c2a2c6 (Sept 2022, part of 6.0.0 development), which predates TuxCare's onboarding of version 6.4.3. While the underlying AesBytesEncryptor class still contains a two-parameter constructor that uses a fixed ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 6.4.3-tuxcare.11 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method was completely removed by upstream Spring Security in commit d996c2a2c6 (Sept 2022, part of 6.0.0 development), which predates TuxCare's onboarding of version 6.4.3. While the underlying AesBytesEncryptor class still contains a two-parameter constructor that uses a fixed ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. CVE-2021-22119 is NOT present in Spring Security 6.4.3. The vulnerability (DoS via unlimited OAuth2 authorization request accumulation) was fixed in upstream commit 35f5ebdbcf, which shipped in Spring Security 5.5.1 (May 2021). Version 6.4.3 contains an evolved version of the fix that completely removes the vulnerable Map-based storage mechanism. The fix was authored by Craig Andrews (candrews@integralblue.com) and was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 is NOT present in Spring Security 6.4.3. The vulnerability (DoS via unlimited OAuth2 authorization request accumulation) was fixed in upstream commit 35f5ebdbcf, which shipped in Spring Security 5.5.1 (May 2021). Version 6.4.3 contains an evolved version of the fix that completely removes the vulnerable Map-based storage mechanism. The fix was authored by Craig Andrews (candrews@integralblue.com) and was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T05:12:00.099497+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 is NOT present in Spring Security 6.4.3. The vulnerability (integer overflow in BCrypt when using work factor 31) was fixed by upstream commit e6297d3bf7 (June 2021), which is included in the 6.4.3 release. The fix changes the rounds variable from int to long and uses safe calculation (1L << log_rounds) via the roundsForLogRounds() helper method, preventing integer overflow. This...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 is NOT present in Spring Security 6.4.3. The vulnerability (integer overflow in BCrypt when using work factor 31) was fixed by upstream commit e6297d3bf7 (June 2021), which is included in the 6.4.3 release. The fix changes the rounds variable from int to long and uses safe calculation (1L << log_rounds) via the roundsForLogRounds() helper method, preventing integer overflow. This..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. The target Spring Security 6.4.3 is not affected by CVE-2022-22978. The vulnerability was fixed in upstream Spring Security 5.5.7 (May 2022) by enabling Pattern.DOTALL by default in RegexRequestMatcher. This fix was already present in the upstream 6.4.3 release before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0 without DOTALL) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "The target Spring Security 6.4.3 is not affected by CVE-2022-22978. The vulnerability was fixed in upstream Spring Security 5.5.7 (May 2022) by enabling Pattern.DOTALL by default in RegexRequestMatcher. This fix was already present in the upstream 6.4.3 release before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0 without DOTALL) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. Spring Security 6.4.3 is NOT affected by CVE-2022-31692 (authorization bypass via FORWARD/INCLUDE dispatcher types). The vulnerability required AuthorizationFilter to extend OncePerRequestFilter, which implicitly skips non-REQUEST dispatcher types. The upstream fix (commit 1f481aafff, Oct 2022) replaced OncePerRequestFilter with GenericFilterBean and added explicit dispatcher-type controls. This upstream fix was already in Spring Security 6.4.3 when TuxCare onboarded it (Apr 2026). The target's AuthorizationFilter extends GenericFilterBean and only skips ERROR/ASYNC dispatcher types - FORWARD and INCLUDE are processed with authorization checks applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Spring Security 6.4.3 is NOT affected by CVE-2022-31692 (authorization bypass via FORWARD/INCLUDE dispatcher types). The vulnerability required AuthorizationFilter to extend OncePerRequestFilter, which implicitly skips non-REQUEST dispatcher types. The upstream fix (commit 1f481aafff, Oct 2022) replaced OncePerRequestFilter with GenericFilterBean and added explicit dispatcher-type controls. This upstream fix was already in Spring Security 6.4.3 when TuxCare onboarded it (Apr 2026). The target's AuthorizationFilter extends GenericFilterBean and only skips ERROR/ASYNC dispatcher types - FORWARD and INCLUDE are processed with authorization checks applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T22:45:14.636645+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.4.3 already contains the upstream fix for CVE-2023-20862. The vulnerability (logout not properly cleaning security context from HTTP session) was fixed in upstream Spring Security by commits 2d52fb8e4b (Clear Repository on Logout) and 8d664bc4c2 (DelegatingSecurityContextRepository should call loadContext), both authored by Marcus Da Coregio. These commits were already present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.3 already contains the upstream fix for CVE-2023-20862. The vulnerability (logout not properly cleaning security context from HTTP session) was fixed in upstream Spring Security by commits 2d52fb8e4b (Clear Repository on Logout) and 8d664bc4c2 (DelegatingSecurityContextRepository should call loadContext), both authored by Marcus Da Coregio. These commits were already present..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. The target Spring Security 6.4.3-tuxcare.11 is not affected by CVE-2024-22234. The vulnerability involves AuthenticationTrustResolver.isFullyAuthenticated() returning an erroneous true when passed a null authentication parameter, leading to broken access control. The upstream fix (commit 750cb30ce4) was already present in Spring Security 6.4.3 before TuxCare onboarded it, and remains intact in the current version. The fix added an explicit isAuthenticated() method with null checking and refactored isFullyAuthenticated() to use it, preventing the null-returns-true bug.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "impact_statement": "The target Spring Security 6.4.3-tuxcare.11 is not affected by CVE-2024-22234. The vulnerability involves AuthenticationTrustResolver.isFullyAuthenticated() returning an erroneous true when passed a null authentication parameter, leading to broken access control. The upstream fix (commit 750cb30ce4) was already present in Spring Security 6.4.3 before TuxCare onboarded it, and remains intact in the current version. The fix added an explicit isAuthenticated() method with null checking and refactored isFullyAuthenticated() to use it, preventing the null-returns-true bug.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:20.912842+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). Version 6.4.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). Version 6.4.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:54.137004+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. Version 6.4.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-hmqf-wpq9-jq83 (affected below 6.3.2), NVD (affected below 6.3.2), CVE record (affected below 6.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "Version 6.4.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-hmqf-wpq9-jq83 (affected below 6.3.2), NVD (affected below 6.3.2), CVE record (affected below 6.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T20:02:15.054048+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38827 addresses locale-dependent case conversion issues in String.toLowerCase() and String.toUpperCase() that could cause authorization bypass. The fix (adding explicit Locale.ROOT or Locale.ENGLISH arguments) was authored by upstream Spring Security maintainer Joe Grandja and shipped in the upstream 6.4.3 release. The target repository (Spring Security 6.4.3-tuxcare.11) inherited this...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38827 addresses locale-dependent case conversion issues in String.toLowerCase() and String.toUpperCase() that could cause authorization bypass. The fix (adding explicit Locale.ROOT or Locale.ENGLISH arguments) was authored by upstream Spring Security maintainer Joe Grandja and shipped in the upstream 6.4.3 release. The target repository (Spring Security 6.4.3-tuxcare.11) inherited this..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "action_statement": "Vulnerability CVE-2025-41232 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41248"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22751"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-15T11:34:00.137653+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core, and is fixed in 6.4.3-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core, and is fixed in 6.4.3-tuxcare.10."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.4.3 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class (with matchInternal() and matchExternal() builders) was introduced in Spring Security 7.1 and does not exist in version 6.4.3. The target has IpAddressMatcher (a different class for CIDR pattern matching) but no code that classifies IP addresses as internal/external for access control purposes.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.3 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class (with matchInternal() and matchExternal() builders) was introduced in Spring Security 7.1 and does not exist in version 6.4.3. The target has IpAddressMatcher (a different class for CIDR pattern matching) but no code that classifies IP addresses as internal/external for access control purposes."
    }
  ]
}