{
  "@id": "urn:uuid:f3dd1257-dd95-4f87-9f58-d49c2215574f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T10:57:00.047796+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "action_statement": "Vulnerability CVE-2009-1190 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "action_statement": "Vulnerability CVE-2011-2730 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "action_statement": "Vulnerability CVE-2011-2894 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-12T10:57:00.047796+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The flawed StringUtils.cleanPath (colon-prefix handling) is present in spring-core 2.5.4, and the CVE-2014-3578 backports are not on HEAD. However, 2.5.4 has no component that maps a request URL path to a Resource and returns its content, so the attacker-to-file-read chain does not exist. ResourceHttpRequestHandler and PathResourceResolver, the exposure points in 3.x/4.0, are absent. Verdict: n...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 The flawed StringUtils.cleanPath (colon-prefix handling) is present in spring-core 2.5.4, and the CVE-2014-3578 backports are not on HEAD. However, 2.5.4 has no component that maps a request URL path to a Resource and returns its content, so the attacker-to-file-read chain does not exist. ResourceHttpRequestHandler and PathResourceResolver, the exposure points in 3.x/4.0, are absent. Verdict: n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target is Spring Framework 2.5.4. It has no SockJS client, no WebSocket module, and no client-side session-id generator. CVE-2015-0201 affects only the Java SockJS client added in the 4.1.x line. The component is absent, so the target is not affected. This is Type A1 (input absent).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 The target is Spring Framework 2.5.4. It has no SockJS client, no WebSocket module, and no client-side session-id generator. CVE-2015-0201 affects only the Java SockJS client added in the 4.1.x line. The component is absent, so the target is not affected. This is Type A1 (input absent)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download) affects the @ResponseBody/HttpEntity HttpMessageConverter response path and URL-extension content negotiation, which were introduced in Spring Framework 3.0. Spring Framework 2.5.4 has no org.springframework.http message converters or @ResponseBody handling; its only response writers in spring-web are the httpinvoker/caucho remoting exporters, which do not reflect request data. The vulnerable code is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download) affects the @ResponseBody/HttpEntity HttpMessageConverter response path and URL-extension content negotiation, which were introduced in Spring Framework 3.0. Spring Framework 2.5.4 has no org.springframework.http message converters or @ResponseBody handling; its only response writers in spring-web are the httpinvoker/caucho remoting exporters, which do not reflect request data. The vulnerable code is not present."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:14:00.059141+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "action_statement": "Vulnerability CVE-2018-11040 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Target is Spring Framework 2.5.4 (TuxCare branch), the same product as the CVE but a far older line than the fixed 4.3.x/5.0.x ones. CVE-2018-1199 is a bypass of a security constraint on Spring MVC static resource URLs through path parameters with special encodings. Spring Security does most of the access checking. 2.5.4 has no MVC static-resource handler and no security-constraint processing, ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Target is Spring Framework 2.5.4 (TuxCare branch), the same product as the CVE but a far older line than the fixed 4.3.x/5.0.x ones. CVE-2018-1199 is a bypass of a security constraint on Spring MVC static resource URLs through path parameters with special encodings. Spring Security does most of the access checking. 2.5.4 has no MVC static-resource handler and no security-constraint processing, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 2.5.4 has no spring-messaging module, no STOMP/WebSocket support, and no in-memory STOMP broker or subscription registry. Its AntPathMatcher is string-based and has no regex. The CVE-2018-1257 attack chain cannot exist here, so the target is not affected (Type A1: input absent).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 2.5.4 has no spring-messaging module, no STOMP/WebSocket support, and no in-memory STOMP broker or subscription registry. Its AntPathMatcher is string-based and has no regex. The CVE-2018-1257 attack chain cannot exist here, so the target is not affected (Type A1: input absent)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "action_statement": "Vulnerability CVE-2018-1258 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Target is Spring Framework 2.5.4. CVE-2018-1271 affects the static-resource serving feature (ResourceHttpRequestHandler / PathResourceResolver, introduced in 3.0.4 / 4.1) when serving from file-system locations on Windows. That component does not exist anywhere in this 2.5.4 tree, and no other code serves static files from a file-system location based on the request path. The only resource-like...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Target is Spring Framework 2.5.4. CVE-2018-1271 affects the static-resource serving feature (ResourceHttpRequestHandler / PathResourceResolver, introduced in 3.0.4 / 4.1) when serving from file-system locations on Windows. That component does not exist anywhere in this 2.5.4 tree, and no other code serves static files from a file-system location based on the request path. The only resource-like..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "action_statement": "Vulnerability CVE-2018-15756 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 2.5.4-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@2.5.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:13:36.987920+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Target is Spring Framework 2.5.4. Its AntPathMatcher has no regex engine and no URI-template support, so there is no catastrophic-backtracking path. The CVE's methods match, matchStart and extractUriTemplateVariables: the first two exist here and use a hand-written, non-regex wildcard matcher. extractUriTemplateVariables does not exist in this version. The pattern flaw fixed upstream (a user-su...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "impact_statement": "not_affected \u2014 Target is Spring Framework 2.5.4. Its AntPathMatcher has no regex engine and no URI-template support, so there is no catastrophic-backtracking path. The CVE's methods match, matchStart and extractUriTemplateVariables: the first two exist here and use a hand-written, non-regex wildcard matcher. extractUriTemplateVariables does not exist in this version. The pattern flaw fixed upstream (a user-su..."
    }
  ]
}