{
  "@id": "urn:uuid:25c90048-1f38-4d6a-bc43-4e0865a71975",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:50:03.446715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-30T12:16:00.176399+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 3.0.5.RELEASE is not affected by CVE-2009-1190. The vulnerability involved an algorithmic complexity attack where malicious serialized data containing regex patterns with multiple optional groups would trigger Pattern.compile() during deserialization, causing CPU exhaustion. The upstream fix (commit 9306d6dbaa, April 2009) removed this attack vector by serializing th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 3.0.5.RELEASE is not affected by CVE-2009-1190. The vulnerability involved an algorithmic complexity attack where malicious serialized data containing regex patterns with multiple optional groups would trigger Pattern.compile() during deserialization, causing CPU exhaustion. The upstream fix (commit 9306d6dbaa, April 2009) removed this attack vector by serializing th..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2011-2730"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2011-2894"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2014-3578"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T19:06:53.108630+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the Java SockJS client component affected by CVE-2015-0201. WebSocket and SockJS support was introduced in Spring Framework 4.0 (December 2013), years after version 3.0.5.RELEASE. Exhaustive searches for SockJS and WebSocket code returned no results, and the module structure confirms the absence of org.springframework.websocket module. The session...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the Java SockJS client component affected by CVE-2015-0201. WebSocket and SockJS support was introduced in Spring Framework 4.0 (December 2013), years after version 3.0.5.RELEASE. Exhaustive searches for SockJS and WebSocket code returned no results, and the module structure confirms the absence of org.springframework.websocket module. The session..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2015-5211"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core. The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 3.0.5.RELEASE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 3.0.5.RELEASE."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the spring-messaging module, which was introduced in Spring Framework 4.0 (released December 2013). The vulnerable classes DefaultSubscriptionRegistry and SimpleBrokerMessageHandler, along with STOMP over WebSocket functionality, do not exist in this version. CVE-2018-1257 specifically affects the spring-messaging module's handling of STOMP subscr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the spring-messaging module, which was introduced in Spring Framework 4.0 (released December 2013). The vulnerable classes DefaultSubscriptionRegistry and SimpleBrokerMessageHandler, along with STOMP over WebSocket functionality, do not exist in this version. CVE-2018-1257 specifically affects the spring-messaging module's handling of STOMP subscr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:00.444930+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the proxy-resolution regression and already preserves the required target-method lookup. org.springframework.aop/src/main/java/org/springframework/aop/support/AopUtils.java:170 passes targetClass directly to method lookup and resolves bridge methods; org.springframework.core/src/main/java/org/springframework/util/ClassUtils.java:699 searches that class for the corresponding method.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the proxy-resolution regression and already preserves the required target-method lookup. org.springframework.aop/src/main/java/org/springframework/aop/support/AopUtils.java:170 passes targetClass directly to method lookup and resolves bridge methods; org.springframework.core/src/main/java/org/springframework/util/ClassUtils.java:699 searches that class for the corresponding method."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1271"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-28T22:02:19.515243+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "action_statement": "Vulnerability CVE-2018-15756 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.0.5.RELEASE-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-22T13:59:14.274953+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}