{ "@id": "urn:uuid:6fee1c80-bb27-4d3a-9552-2abd55569191", "role": "Document Creator", "author": "https://tuxcare.com", "version": 38, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:05:51.407283+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T12:09:48.333130+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 4.0.0.RELEASE is not affected by CVE-2009-1190. While the Serializable regex pattern code still exists in AbstractRegexpMethodPointcut and JdkRegexpMethodPointcut, the underlying JDK vulnerability that this CVE exploits was fixed in JDK 1.6+. Spring Framework 4.0.0.RELEASE requires JDK 8 (with sourceCompatibility=1.6), making exploitation impossible. The CVE explicitly identifi...", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 Spring Framework 4.0.0.RELEASE is not affected by CVE-2009-1190. While the Serializable regex pattern code still exists in AbstractRegexpMethodPointcut and JdkRegexpMethodPointcut, the underlying JDK vulnerability that this CVE exploits was fixed in JDK 1.6+. Spring Framework 4.0.0.RELEASE requires JDK 8 (with sourceCompatibility=1.6), making exploitation impossible. The CVE explicitly identifi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T17:30:26.757723+00:00", "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.0.0.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2730" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.0.0.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T09:39:00.037443+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 is not present in Spring Framework 4.0.0.RELEASE. The vulnerability (uncontrolled deserialization of Java proxy objects enabling arbitrary code execution) was fixed by upstream commit 7d8aa05c407 (July 2011) which added the acceptProxyClasses flag and validation mechanism to ConfigurableObjectInputStream.resolveProxyClass(). This fix shipped with Spring Framework 4.0.0.RELEASE bef...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 CVE-2011-2894 is not present in Spring Framework 4.0.0.RELEASE. The vulnerability (uncontrolled deserialization of Java proxy objects enabling arbitrary code execution) was fixed by upstream commit 7d8aa05c407 (July 2011) which added the acceptProxyClasses flag and validation mechanism to ConfigurableObjectInputStream.resolveProxyClass(). This fix shipped with Spring Framework 4.0.0.RELEASE bef..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-3578 is fixed in version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2014-3578" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T20:55:27.082072+00:00", "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. HEAD\u2019s tracked SockJS tree contains only `frame`, `support`, and `transport`; the `sockjs/client` package, `SockJsClient`, and `SockJsUrlInfo` are absent. The implemented SockJS API processes HTTP requests from clients (SockJsService.java:25). Its server extracts the session ID from the request path and passes it to transport handling (AbstractSockJsService.java:308). Session creation preserves that supplied ID (TransportHandlingSockJsService.java:286). The server\u2019s `random.nextInt()` populates `/info` response entropy, with no session-ID generation at that call site (AbstractSockJsService.java:418, line 426). The affected client generator call site is absent, so missing fix lines do not establish vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-0201" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. HEAD\u2019s tracked SockJS tree contains only `frame`, `support`, and `transport`; the `sockjs/client` package, `SockJsClient`, and `SockJsUrlInfo` are absent. The implemented SockJS API processes HTTP requests from clients (SockJsService.java:25). Its server extracts the session ID from the request path and passes it to transport handling (AbstractSockJsService.java:308). Session creation preserves that supplied ID (TransportHandlingSockJsService.java:286). The server\u2019s `random.nextInt()` populates `/info` response entropy, with no session-ID generation at that call site (AbstractSockJsService.java:418, line 426). The affected client generator call site is absent, so missing fix lines do not establish vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5211 is fixed in version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2015-5211" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-5007 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.0.0.RELEASE-tuxcare.2.", "vulnerability": { "name": "CVE-2016-5007" }, "action_statement": "Vulnerability CVE-2016-5007 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.0.0.RELEASE-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-11040 does not affect version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 4.0.0.RELEASE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11040" }, "impact_statement": "The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 4.0.0.RELEASE." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2018-1199 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1199" }, "action_statement": "Vulnerability CVE-2018-1199 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-19T14:55:10.536690+00:00", "status_notes": "Vulnerability CVE-2018-1257 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1257" }, "action_statement": "Vulnerability CVE-2018-1257 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-10T04:20:04.842645+00:00", "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the regression that replaces a JDK proxy target class with null during method resolution. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:177 passes the actual target class directly, and spring-core/src/main/java/org/springframework/util/ClassUtils.java:744 resolves public methods using targetClass.getMethod, including methods declared by proxy classes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1258" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the regression that replaces a JDK proxy target class with null during method resolution. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:177 passes the actual target class directly, and spring-core/src/main/java/org/springframework/util/ClassUtils.java:744 resolves public methods using targetClass.getMethod, including methods declared by proxy classes." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1271" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1272" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T22:02:19.515243+00:00", "status_notes": "Vulnerability CVE-2018-15756 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-15756" }, "action_statement": "Vulnerability CVE-2018-15756 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-08T12:52:02.072004+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.0.0.RELEASE-tuxcare.4.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.0.0.RELEASE-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-08T12:52:02.072004+00:00", "status_notes": "Vulnerability CVE-2021-22096 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.0.0.RELEASE-tuxcare.4.", "vulnerability": { "name": "CVE-2021-22096" }, "action_statement": "Vulnerability CVE-2021-22096 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.0.0.RELEASE-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T18:34:00.158763+00:00", "status_notes": "Vulnerability CVE-2024-22233 does not affect version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, and this version declares none of the classes the fix changes. Version 4.0.0.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-r4q3-7g4q-x89m (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-22233" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, and this version declares none of the classes the fix changes. Version 4.0.0.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-r4q3-7g4q-x89m (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41249 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2025-41249" }, "action_statement": "Vulnerability CVE-2025-41249 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.0.0.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-08T12:52:02.072004+00:00", "status_notes": "Vulnerability CVE-2026-41848 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.0.0.RELEASE-tuxcare.4.", "vulnerability": { "name": "CVE-2026-41848" }, "action_statement": "Vulnerability CVE-2026-41848 affects version 4.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.0.0.RELEASE-tuxcare.4." } ] }