{ "@id": "urn:uuid:af9c9174-ae69-4bd7-b5df-b5f71ddfbe66", "role": "Document Creator", "author": "https://tuxcare.com", "version": 42, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:05:51.407283+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T11:56:16.452607+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is a vulnerability in JDK before 1.6's Pattern.compile method that causes CPU exhaustion via malicious regex patterns. Spring Framework 4.3.16.RELEASE requires JDK 1.6 or later to run (sourceCompatibility = 1.6), making the vulnerable runtime environment unsupported. While Spring uses Pattern.compile without additional validation in PatternEditor, OperatorMatches, and JdkRegexpMet...", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 CVE-2009-1190 is a vulnerability in JDK before 1.6's Pattern.compile method that causes CPU exhaustion via malicious regex patterns. Spring Framework 4.3.16.RELEASE requires JDK 1.6 or later to run (sourceCompatibility = 1.6), making the vulnerable runtime environment unsupported. While Spring uses Pattern.compile without additional validation in PatternEditor, OperatorMatches, and JdkRegexpMet..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-06T17:27:46.722408+00:00", "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.16.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2730" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.16.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T09:31:48.808270+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 is NOT present in Spring Framework 4.3.16.RELEASE. The vulnerability concerns unsafe deserialization of Java proxy classes that could lead to arbitrary code execution. The fix (adding an acceptProxyClasses flag with validation in ConfigurableObjectInputStream.resolveProxyClass()) was introduced by upstream Spring maintainer Juergen Hoeller in commit 7d8aa05c40 and was already pres...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 CVE-2011-2894 is NOT present in Spring Framework 4.3.16.RELEASE. The vulnerability concerns unsafe deserialization of Java proxy classes that could lead to arbitrary code execution. The fix (adding an acceptProxyClasses flag with validation in ConfigurableObjectInputStream.resolveProxyClass()) was introduced by upstream Spring maintainer Juergen Hoeller in commit 7d8aa05c40 and was already pres..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 4.3.16.RELEASE-tuxcare.2 is NOT affected by CVE-2014-3578. The vulnerability (directory traversal via crafted URLs with colons in path segments) was fixed by upstream Spring Framework in version 4.0.5. The fix was already present in the upstream 4.3.16.RELEASE that TuxCare onboarded at commit f0d69b37a8. The defense code (lines 641-643 of StringUtils.java) validates ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3578" }, "impact_statement": "not_affected \u2014 The target Spring Framework 4.3.16.RELEASE-tuxcare.2 is NOT affected by CVE-2014-3578. The vulnerability (directory traversal via crafted URLs with colons in path segments) was fixed by upstream Spring Framework in version 4.0.5. The fix was already present in the upstream 4.3.16.RELEASE that TuxCare onboarded at commit f0d69b37a8. The defense code (lines 641-643 of StringUtils.java) validates ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T19:05:00.096825+00:00", "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses non-secure Random after initial seed). The vulnerability was fixed in upstream commit d63cfc8eeb (January 2015) by switching to JdkIdGenerator, which uses cryptographically secure UUID.randomUUID(). The target version 4.3.16.RELEAS...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-0201" }, "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses non-secure Random after initial seed). The vulnerability was fixed in upstream commit d63cfc8eeb (January 2015) by switching to JdkIdGenerator, which uses cryptographically secure UUID.randomUUID(). The target version 4.3.16.RELEAS..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T12:52:53.936815+00:00", "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 4.3.16.RELEASE shipped with CVE-2015-5211 (Reflected File Download) already fixed by upstream vendor. The RFD defense commit 2bd1daa75ee0b8ec33608ca6ab065ef3e1815543 authored by rstoyanchev@pivotal.io on 2015-10-04 is an ancestor of TuxCare's onboarding commit f0d69b37a8330c06221bceb16337198a3ed9b2dc. All defense components verified present: Content-Disposition header injection for unsafe extensions (AbstractMessageConverterMethodProcessor.java:350), path parameter handling (WebUtils.java:752-753), JSONP callback validation and prefix. CVE affected versions 4.2.0-4.2.1, 4.0.0-4.1.7, 3.2.0-3.2.14; target 4.3.16 is newer and contains fix from v4.2.2.RELEASE onward.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-5211" }, "impact_statement": "Spring Framework 4.3.16.RELEASE shipped with CVE-2015-5211 (Reflected File Download) already fixed by upstream vendor. The RFD defense commit 2bd1daa75ee0b8ec33608ca6ab065ef3e1815543 authored by rstoyanchev@pivotal.io on 2015-10-04 is an ancestor of TuxCare's onboarding commit f0d69b37a8330c06221bceb16337198a3ed9b2dc. All defense components verified present: Content-Disposition header injection for unsafe extensions (AbstractMessageConverterMethodProcessor.java:350), path parameter handling (WebUtils.java:752-753), JSONP callback validation and prefix. CVE affected versions 4.2.0-4.2.1, 4.0.0-4.1.7, 3.2.0-3.2.14; target 4.3.16 is newer and contains fix from v4.2.2.RELEASE onward.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T13:05:07.573388+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 describes pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass. The fix (HandlerMapping introspection API introduced in commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by upstream Spring team in April 2016) was already present in the upstream Spring Framework 4.3.16.RELEASE that TuxCare onboarded. All fix components are present in the target: MatchableHandlerMapping interface, HandlerMappingIntrospector class, match() methods in AbstractUrlHandlerMapping and RequestMappingHandlerMapping, and CorsConfigurationSource implementations. The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "CVE-2016-5007 describes pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass. The fix (HandlerMapping introspection API introduced in commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by upstream Spring team in April 2016) was already present in the upstream Spring Framework 4.3.16.RELEASE that TuxCare onboarded. All fix components are present in the target: MatchableHandlerMapping interface, HandlerMappingIntrospector class, match() methods in AbstractUrlHandlerMapping and RequestMappingHandlerMapping, and CorsConfigurationSource implementations. The vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T15:48:13.607959+00:00", "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-11040" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T00:50:41.219686+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 (SPR-16616) describes a path traversal vulnerability where URL paths with special encodings (backslashes, duplicate slashes, encoded traversal sequences) can bypass security constraints to access files outside intended resource locations. The fix adds path normalization (backslash\u2192slash replacement, duplicate slash removal) and encoded path traversal detection (URL-decoding and ch...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 CVE-2018-1199 (SPR-16616) describes a path traversal vulnerability where URL paths with special encodings (backslashes, duplicate slashes, encoded traversal sequences) can bypass security constraints to access files outside intended resource locations. The fix adds path normalization (backslash\u2192slash replacement, duplicate slash removal) and encoded path traversal detection (URL-decoding and ch..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T15:48:13.607959+00:00", "status_notes": "Vulnerability CVE-2018-1257 is fixed in version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1257" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-10T04:20:04.842645+00:00", "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable exclusion of JDK proxy classes from method resolution is absent. In spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190, the target class is passed directly to the method resolver, which retrieves the target\u2019s public method in spring-core/src/main/java/org/springframework/util/ClassUtils.java:777.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1258" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable exclusion of JDK proxy classes from method resolution is absent. In spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190, the target class is passed directly to the method resolver, which retrieves the target\u2019s public method in spring-core/src/main/java/org/springframework/util/ClassUtils.java:777." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T18:16:00.114052+00:00", "status_notes": "Vulnerability CVE-2018-1271 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target Spring Framework 4.3.16.RELEASE is NOT affected by CVE-2018-1271. The directory traversal vulnerability has been fixed by upstream commit b9ebdaaf (Rossen Stoyanchev) that normalizes path separators (backslash to forward slash, duplicate slash removal) before validation. This fix was shipped in the upstream 4.3.16.RELEASE and was present when TuxCare onboarded the version. The vulnerable...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1271" }, "impact_statement": "not_affected \u2014 Target Spring Framework 4.3.16.RELEASE is NOT affected by CVE-2018-1271. The directory traversal vulnerability has been fixed by upstream commit b9ebdaaf (Rossen Stoyanchev) that normalizes path separators (backslash to forward slash, duplicate slash removal) before validation. This fix was shipped in the upstream 4.3.16.RELEASE and was present when TuxCare onboarded the version. The vulnerable..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2018-1272 affects version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1272" }, "action_statement": "Vulnerability CVE-2018-1272 affects version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T15:48:13.607959+00:00", "status_notes": "Vulnerability CVE-2018-15756 is fixed in version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-15756" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T15:48:36.163004+00:00", "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22096" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T03:48:46.502543+00:00", "status_notes": "Vulnerability CVE-2024-22233 affects version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2024-22233" }, "action_statement": "Vulnerability CVE-2024-22233 affects version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T15:48:13.607959+00:00", "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2025-41249" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.16.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T15:48:13.607959+00:00", "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2026-41848" }, "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-core." } ] }