{
  "@id": "urn:uuid:de19d165-832d-4181-a9d9-13da605b9e29",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:43:20.912842+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T20:59:31.949589+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints by adding path parameters (e.g., `/admin.html;x=user.html`) to URLs. The target repository is Spring Security 6.5.11-tuxcare.4, which contains the upstream fix (SEC-1584, commit 7d97adc687) authored by Luke Taylor. The fix introduces HttpFirewall infrastructure with Req...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints by adding path parameters (e.g., `/admin.html;x=user.html`) to URLs. The target repository is Spring Security 6.5.11-tuxcare.4, which contains the upstream fix (SEC-1584, commit 7d97adc687) authored by Luke Taylor. The fix introduces HttpFirewall infrastructure with Req..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:31:56.289601+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager allowing privilege escalation via shared SecurityContext) was fixed in upstream Spring Security versions 2.0.7 and 3.0.6 (released 2011-2012). The target contains the complete fix, which was already present in the upstream 6.5.11 release before TuxCare onboarded it. The vulnerable pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager allowing privilege escalation via shared SecurityContext) was fixed in upstream Spring Security versions 2.0.7 and 3.0.6 (released 2011-2012). The target contains the complete fix, which was already present in the upstream 6.5.11 release before TuxCare onboarded it. The vulnerable pattern ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:09:39.867220+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 is not present in Spring Security 6.5.11. Both required defenses are present: (1) CR/LF validation in FirewalledResponse.sendRedirect() blocks malicious redirect locations, and (2) targetUrlParameter defaults to null in the parent class AbstractAuthenticationTargetUrlRequestHandler, preventing the spring-security-redirect parameter from being read. Both defenses originated from up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 is not present in Spring Security 6.5.11. Both required defenses are present: (1) CR/LF validation in FirewalledResponse.sendRedirect() blocks malicious redirect locations, and (2) targetUrlParameter defaults to null in the parent class AbstractAuthenticationTargetUrlRequestHandler, preventing the spring-security-redirect parameter from being read. Both defenses originated from up..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T22:48:08.143939+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.5.11 is not affected by CVE-2011-2894. The vulnerable code (ContextPropagatingRemoteInvocation class and the entire spring-security-remoting module) was removed by upstream Spring Security in October 2021 (commit b2e6c60d94, included in version 6.0.0). The removal was part of the upstream release that TuxCare later onboarded. The target does not receive or process t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.5.11 is not affected by CVE-2011-2894. The vulnerable code (ContextPropagatingRemoteInvocation class and the entire spring-security-remoting module) was removed by upstream Spring Security in October 2021 (commit b2e6c60d94, included in version 6.0.0). The removal was part of the upstream release that TuxCare later onboarded. The target does not receive or process t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T21:17:59.994008+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2012-5055. The timing attack vulnerability in DaoAuthenticationProvider was fixed in upstream Spring Security (commit c076f0f2e1 by Rob Winch @vmware.com) long before this version. The fix was already present in the Spring Security 6.5.11 release that TuxCare onboarded. The current code includes complete timing attack mitigation: when a user is not ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2012-5055. The timing attack vulnerability in DaoAuthenticationProvider was fixed in upstream Spring Security (commit c076f0f2e1 by Rob Winch @vmware.com) long before this version. The fix was already present in the Spring Security 6.5.11 release that TuxCare onboarded. The current code includes complete timing attack mitigation: when a user is not ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T17:41:00.166714+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 6.5.11 contains the upstream fix for CVE-2014-3527 (SEC-2688) that was committed by Rob Winch (rwinch@gopivotal.com) on 2014-07-24 and shipped in the upstream release. The vulnerability allowed malicious CAS Services to impersonate other services by manipulating HTTP Host headers during proxy ticket authentication. The fix replaced untrusted HttpServletRequest data (scheme/serverName/serverPort) with pre-configured service URL values when building the service identifier. The vulnerable code pattern is not present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "Spring Security 6.5.11 contains the upstream fix for CVE-2014-3527 (SEC-2688) that was committed by Rob Winch (rwinch@gopivotal.com) on 2014-07-24 and shipped in the upstream release. The vulnerability allowed malicious CAS Services to impersonate other services by manipulating HTTP Host headers during proxy ticket authentication. The fix replaced untrusted HttpServletRequest data (scheme/serverName/serverPort) with pre-configured service URL values when building the service identifier. The vulnerable code pattern is not present in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:57.157354+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security version 6.5.11-tuxcare.4 is not affected by CVE-2016-5007. Both defense mechanisms introduced by the upstream vendor in 2016 are present: (1) MvcRequestMatcher for consistent URL matching between security rules and Spring MVC controllers, and (2) DefaultHttpFirewall/StrictHttpFirewall blocking of URL-encoded slashes. These fixes were already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded on 2026-07-06, not added as TuxCare backports. The vulnerable pattern (URL path matching discrepancies leading to authorization bypass) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target Spring Security version 6.5.11-tuxcare.4 is not affected by CVE-2016-5007. Both defense mechanisms introduced by the upstream vendor in 2016 are present: (1) MvcRequestMatcher for consistent URL matching between security rules and Spring MVC controllers, and (2) DefaultHttpFirewall/StrictHttpFirewall blocking of URL-encoded slashes. These fixes were already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded on 2026-07-06, not added as TuxCare backports. The vulnerable pattern (URL path matching discrepancies leading to authorization bypass) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:10:20.881763+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 6.5.11 is not affected by CVE-2016-9879. The vulnerability involves bypassing security constraints using URL-encoded slashes (%2f or %2F) in path parameters. The upstream fix (commit 666e356ebc by Rob Winch) was already present in Spring Security 6.5.11 when TuxCare onboarded it. The DefaultHttpFirewall class contains the containsInvalidUrlEncodedSlash() method that rejects requests with encoded slashes by default, preventing the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Spring Security 6.5.11 is not affected by CVE-2016-9879. The vulnerability involves bypassing security constraints using URL-encoded slashes (%2f or %2F) in path parameters. The upstream fix (commit 666e356ebc by Rob Winch) was already present in Spring Security 6.5.11 when TuxCare onboarded it. The DefaultHttpFirewall class contains the containsInvalidUrlEncodedSlash() method that rejects requests with encoded slashes by default, preventing the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2017-4995: Spring Security 6.5.11 is not affected. The vulnerability (arbitrary code execution via Jackson deserialization gadgets when default typing is enabled) was fixed in the upstream Spring Security release that TuxCare onboarded. The fix commit 5dee8534cd by Rob Winch predates the first TuxCare commit (bdf9128d7f \"Onboard version 6.5.11\"). The target contains the complete defense: AllowlistTypeIdResolver validates all class names during deserialization, rejecting any class not in the allowlist, not annotated with Jackson mappings, and not having an explicit mixin.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "CVE-2017-4995: Spring Security 6.5.11 is not affected. The vulnerability (arbitrary code execution via Jackson deserialization gadgets when default typing is enabled) was fixed in the upstream Spring Security release that TuxCare onboarded. The fix commit 5dee8534cd by Rob Winch predates the first TuxCare commit (bdf9128d7f \"Onboard version 6.5.11\"). The target contains the complete defense: AllowlistTypeIdResolver validates all class names during deserialization, rejecting any class not in the allowlist, not annotated with Jackson mappings, and not having an explicit mixin.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:44:06.899174+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2018-1199. The upstream fix (StrictHttpFirewall) was already present in version 6.5.11 when TuxCare onboarded it. StrictHttpFirewall rejects requests containing semicolons (`;`, `%3b`, `%3B`) and other special characters that could be used to bypass security constraints via URL path parameter manipulation. The fix is active by default in FilterChain...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2018-1199. The upstream fix (StrictHttpFirewall) was already present in version 6.5.11 when TuxCare onboarded it. StrictHttpFirewall rejects requests containing semicolons (`;`, `%3b`, `%3B`) and other special characters that could be used to bypass security constraints via URL path parameter manipulation. The fix is active by default in FilterChain..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2018-15801 is NOT present in the target repository. The vulnerability involved using Java's URL.equals() method for JWT issuer validation, which performs DNS resolution and could allow different issuer URL strings to be treated as equivalent if they resolve to the same IP address. The fix (commit 19649db9ce, November 13, 2018) converted issuer validation from URL object comparison to string comparison. This fix was already present in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The current code uses string-based comparison via issuer.equals(claimValue.toString()) and contains no URL object equality checks in the issuer validation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 is NOT present in the target repository. The vulnerability involved using Java's URL.equals() method for JWT issuer validation, which performs DNS resolution and could allow different issuer URL strings to be treated as equivalent if they resolve to the same IP address. The fix (commit 19649db9ce, November 13, 2018) converted issuer validation from URL object comparison to string comparison. This fix was already present in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The current code uses string-based comparison via issuer.equals(claimValue.toString()) and contains no URL object equality checks in the issuer validation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 6.5.11 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was completely removed from Spring Security in October 2017 (commit 12dbf2e961) as part of an upstream architectural refactoring for version 5.0+. This removal happened years before version 6.5.11 was created and before TuxCare's onboarding. The CVE affects versions 4.2.x and earlier that still contained the authentication.encoding.PlaintextPasswordEncoder class. Version 6.5.11 uses the modern crypto.password package with a completely different architecture that does not have the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 6.5.11 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was completely removed from Spring Security in October 2017 (commit 12dbf2e961) as part of an upstream architectural refactoring for version 5.0+. This removal happened years before version 6.5.11 was created and before TuxCare's onboarding. The CVE affects versions 4.2.x and earlier that still contained the authentication.encoding.PlaintextPasswordEncoder class. Version 6.5.11 uses the modern crypto.password package with a completely different architecture that does not have the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T23:56:59.714304+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 affects Spring Security's SecureRandomFactoryBean when a custom seed is provided via setSeed(). The vulnerability allowed predictable random values because calling setSeed() on an uninitialized SecureRandom replaced the entire internal state instead of mixing with system entropy. The target (Spring Security 6.5.11) contains the upstream fix authored by Josh Cummings that calls nex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 affects Spring Security's SecureRandomFactoryBean when a custom seed is provided via setSeed(). The vulnerability allowed predictable random values because calling setSeed() on an uninitialized SecureRandom replaced the entire internal state instead of mixing with system entropy. The target (Spring Security 6.5.11) contains the upstream fix authored by Josh Cummings that calls nex..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T22:07:50.682094+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 affects Spring Security's queryableText() encryptor method which used a fixed null initialization vector with CBC mode, enabling dictionary attacks. The target repository at version 6.5.11 is NOT AFFECTED because the vulnerable queryableText() method was completely removed from the codebase in upstream commit d996c2a2c6 (September 2022) by Rob Winch. This removal was already prese...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects Spring Security's queryableText() encryptor method which used a fixed null initialization vector with CBC mode, enabling dictionary attacks. The target repository at version 6.5.11 is NOT AFFECTED because the vulnerable queryableText() method was completely removed from the codebase in upstream commit d996c2a2c6 (September 2022) by Rob Winch. This removal was already prese..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 6.5.11-tuxcare.4 is NOT affected by CVE-2021-22119. The vulnerability (DoS via unlimited accumulation of OAuth2 authorization requests in session storage) has been fixed by upstream commit 35f5ebdbcf, which was already present in the Spring Security 6.5.11 release that TuxCare onboarded. The target uses single-request storage that overwrites previous requests, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target Spring Security 6.5.11-tuxcare.4 is NOT affected by CVE-2021-22119. The vulnerability (DoS via unlimited accumulation of OAuth2 authorization requests in session storage) has been fixed by upstream commit 35f5ebdbcf, which was already present in the Spring Security 6.5.11 release that TuxCare onboarded. The target uses single-request storage that overwrites previous requests, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:12:00.099497+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 (BCrypt integer overflow with work factor 31) is NOT present in Spring Security 6.5.11-tuxcare.4. The vulnerability pattern was removed by an upstream fix (commit b0b4612609) authored by Josh Cummings in July 2022, which shipped in the upstream Spring Security release before TuxCare onboarded version 6.5.11. The fix prevents integer overflow by using long arithmetic (1L << log_ro...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 (BCrypt integer overflow with work factor 31) is NOT present in Spring Security 6.5.11-tuxcare.4. The vulnerability pattern was removed by an upstream fix (commit b0b4612609) authored by Josh Cummings in July 2022, which shipped in the upstream Spring Security release before TuxCare onboarded version 6.5.11. The fix prevents integer overflow by using long arithmetic (1L << log_ro..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 6.5.11 is NOT AFFECTED by CVE-2022-22978. The vulnerability (RegexRequestMatcher missing Pattern.DOTALL flag, allowing authorization bypass via newline characters in request paths) is not present in this version. The fix was authored by upstream maintainer Rob Winch (commit 472c25b5e8) and shipped in the upstream Spring Security 6.5.11 release before TuxCare onboarded it. The target contains Pattern.DOTALL at line 46 of RegexRequestMatcher.java, ensuring the `.` metacharacter matches line terminators, preventing bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "Spring Security 6.5.11 is NOT AFFECTED by CVE-2022-22978. The vulnerability (RegexRequestMatcher missing Pattern.DOTALL flag, allowing authorization bypass via newline characters in request paths) is not present in this version. The fix was authored by upstream maintainer Rob Winch (commit 472c25b5e8) and shipped in the upstream Spring Security 6.5.11 release before TuxCare onboarded it. The target contains Pattern.DOTALL at line 46 of RegexRequestMatcher.java, ensuring the `.` metacharacter matches line terminators, preventing bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2022-31692 describes an authorization bypass vulnerability in Spring Security's AuthorizationFilter when using FORWARD or INCLUDE dispatcher types. The vulnerability existed because AuthorizationFilter extended OncePerRequestFilter, which automatically skips FORWARD and INCLUDE dispatcher types, allowing unauthorized access to protected endpoints. The target repository (Spring Security 6.5.11) already contains the upstream fix (commit 1f481aafff) that was shipped in the upstream release. The fix changes AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean with explicit dispatcher type handling, ensuring authorization checks apply to FORWARD and INCLUDE requests. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 describes an authorization bypass vulnerability in Spring Security's AuthorizationFilter when using FORWARD or INCLUDE dispatcher types. The vulnerability existed because AuthorizationFilter extended OncePerRequestFilter, which automatically skips FORWARD and INCLUDE dispatcher types, allowing unauthorized access to protected endpoints. The target repository (Spring Security 6.5.11) already contains the upstream fix (commit 1f481aafff) that was shipped in the upstream release. The fix changes AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean with explicit dispatcher type handling, ensuring authorization checks apply to FORWARD and INCLUDE requests. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T22:45:14.636645+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 6.5.11 is NOT affected by CVE-2023-20862. The vulnerability (logout not clearing serialized security context) was fixed in upstream Spring Security commits 2d52fb8e4b (main fix) and 8d664bc4c2 (delegating repository fix), which shipped in version 6.5.11. TuxCare onboarded this version with the fixes already present. The defense mechanism is confirmed in the target code: S...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 6.5.11 is NOT affected by CVE-2023-20862. The vulnerability (logout not clearing serialized security context) was fixed in upstream Spring Security commits 2d52fb8e4b (main fix) and 8d664bc4c2 (delegating repository fix), which shipped in version 6.5.11. TuxCare onboarded this version with the fixes already present. The defense mechanism is confirmed in the target code: S..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2024-22234 affects Spring Security 6.1.x prior to 6.1.7 and 6.2.x prior to 6.2.2. The target version is 6.5.11-tuxcare.4, which is significantly newer. The vulnerability involved AuthenticationTrustResolver.isFullyAuthenticated() returning true when passed null authentication, causing broken access control. The upstream fix (commit 750cb30ce4 by Rob Winch) added a new isAuthenticated() method with explicit null checking and refactored isFullyAuthenticated() to use it. This fix was already present in upstream Spring Security 6.5.11 when TuxCare onboarded it (commit bdf9128d7f by evasilev@cloudlinux.com). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "impact_statement": "CVE-2024-22234 affects Spring Security 6.1.x prior to 6.1.7 and 6.2.x prior to 6.2.2. The target version is 6.5.11-tuxcare.4, which is significantly newer. The vulnerability involved AuthenticationTrustResolver.isFullyAuthenticated() returning true when passed null authentication, causing broken access control. The upstream fix (commit 750cb30ce4 by Rob Winch) added a new isAuthenticated() method with explicit null checking and refactored isFullyAuthenticated() to use it. This fix was already present in upstream Spring Security 6.5.11 when TuxCare onboarded it (commit bdf9128d7f by evasilev@cloudlinux.com). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:20.912842+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 6.5.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 6.5.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:50:26.784780+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38810 affects Spring Security 6.3.0 and 6.3.1 where @AuthorizeReturnObject annotation could fail to apply authorization checks due to uninitialized authorizationProxyFactory. The target version 6.5.11 contains upstream fix commit 5841e35cae which inverted the dependency injection pattern, added null checks, and ensured proper initialization order. The fix was already present in the ups...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38810 affects Spring Security 6.3.0 and 6.3.1 where @AuthorizeReturnObject annotation could fail to apply authorization checks due to uninitialized authorizationProxyFactory. The target version 6.5.11 contains upstream fix commit 5841e35cae which inverted the dependency injection pattern, added null checks, and ensured proper initialization order. The fix was already present in the ups..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T20:02:15.054048+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2024-38827. The vulnerability involves locale-dependent string case transformations in authorization code that could bypass security rules. However, the upstream Spring Security team already fixed this issue in version 6.5.11 (commit a7bf8f7cc68d95ce30f18722f5d441ea3fa798f4 by Joe Grandja) before TuxCare onboarded the version. All producti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2024-38827. The vulnerability involves locale-dependent string case transformations in authorization code that could bypass security rules. However, the upstream Spring Security team already fixed this issue in version 6.5.11 (commit a7bf8f7cc68d95ce30f18722f5d441ea3fa798f4 by Joe Grandja) before TuxCare onboarded the version. All producti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:18:37.843029+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2025-22223. The vulnerability (method security annotations not being located on parameterized types/methods) was fixed by upstream Spring Security in commit dc2e1af2dab8ef81cd4edd25b56a2babeaab8cf9 (authored by Josh Cummings on 2025-01-08). This fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2025-22223. The vulnerability (method security annotations not being located on parameterized types/methods) was fixed by upstream Spring Security in commit dc2e1af2dab8ef81cd4edd25b56a2babeaab8cf9 (authored by Josh Cummings on 2025-01-08). This fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2025-22234 is not present in spring-security 6.5.11-tuxcare.4. The vulnerability (timing attack side channel in DaoAuthenticationProvider due to CVE-2025-22228's 72-byte password limit) was fixed by upstream Spring Security maintainer Joe Grandja in commit c1aa99fdd21 (April 17, 2025), which was already included in the upstream 6.5.11 release that TuxCare onboarded. The fix adds a `for_chec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 is not present in spring-security 6.5.11-tuxcare.4. The vulnerability (timing attack side channel in DaoAuthenticationProvider due to CVE-2025-22228's 72-byte password limit) was fixed by upstream Spring Security maintainer Joe Grandja in commit c1aa99fdd21 (April 17, 2025), which was already included in the upstream 6.5.11 release that TuxCare onboarded. The fix adds a `for_chec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:52:09.988158+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 6.5.11 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.5.11 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T11:37:35.533056+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. Spring Security 6.5.11 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 6.5.11 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T14:43:41.647513+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22746. The timing attack defense was implemented via commit a317a3d8663995daa2bc91593bb88ae2da21ea52 (April 15, 2026), which ensures constant-time authentication by always executing password verification even when account state checks fail.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22746"
      },
      "impact_statement": "already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22746. The timing attack defense was implemented via commit a317a3d8663995daa2bc91593bb88ae2da21ea52 (April 15, 2026), which ensures constant-time authentication by always executing password verification even when account state checks fail."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 6.5.11-tuxcare.4) is not affected by CVE-2026-22751. The TOCTOU race condition vulnerability in JdbcOneTimeTokenService was already fixed in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The vulnerable code pattern (SELECT without verifying DELETE succeeded) is not present in the target. The fix verifies that the DELETE operation remo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 6.5.11-tuxcare.4) is not affected by CVE-2026-22751. The TOCTOU race condition vulnerability in JdbcOneTimeTokenService was already fixed in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The vulnerable code pattern (SELECT without verifying DELETE succeeded) is not present in the target. The fix verifies that the DELETE operation remo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T12:33:23.004157+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 6.5.11-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core, and is fixed in 6.5.11-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.5.11-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() builders was introduced in Spring Security 7.1, but the target version is 6.5.11. The entire affected class does not exist in this version, so the vulnerability pattern cannot be present. This is a Type A1 case where the vulnerable code was not yet in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() builders was introduced in Spring Security 7.1, but the target version is 6.5.11. The entire affected class does not exist in this version, so the vulnerability pattern cannot be present. This is a Type A1 case where the vulnerable code was not yet in..."
    }
  ]
}