{
  "@id": "urn:uuid:307806d5-6ee2-4a6d-885a-dc690228cc50",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 43,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:21:52.088444+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T13:09:28.641700+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in java.util.regex.Pattern.compile affecting JDK versions before 1.6. Spring Framework 4.3.20 still contains the HttpInvokerServiceExporter deserialization mechanism that can process RemoteInvocation objects containing Pattern instances. However, the target is not affected because: (1) The vulnerability exists in JDK < 1.6, not in Spring ...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in java.util.regex.Pattern.compile affecting JDK versions before 1.6. Spring Framework 4.3.20 still contains the HttpInvokerServiceExporter deserialization mechanism that can process RemoteInvocation objects containing Pattern instances. However, the target is not affected because: (1) The vulnerability exists in JDK < 1.6, not in Spring ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:41:00.055463+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.20.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.20.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:51:00.166719+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0 through 3.0.5 due to unsafe deserialization of proxy classes and AOP interfaces. The target repository (Spring Framework 4.3.20.RELEASE) contains the upstream fix introduced in commit 7d8aa05c40 (2011-07-21) by Juergen Hoeller. The fix adds an acceptProxyClasses flag that blocks deserialization of java.lang.Proxy instances when set to false. This def...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0 through 3.0.5 due to unsafe deserialization of proxy classes and AOP interfaces. The target repository (Spring Framework 4.3.20.RELEASE) contains the upstream fix introduced in commit 7d8aa05c40 (2011-07-21) by Juergen Hoeller. The fix adds an acceptProxyClasses flag that blocks deserialization of java.lang.Proxy instances when set to false. This def..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 does not affect Spring Framework 4.3.20.RELEASE. The directory traversal vulnerability in StringUtils.cleanPath() was fixed by the upstream Spring Framework team in May 2014 (commit 8ee4651038, addressing SPR-11793). The fix validates that extracted URI scheme prefixes don't contain forward slashes, preventing paths like \"/a/:b/../../etc/passwd\" from being misinterpreted. This fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 does not affect Spring Framework 4.3.20.RELEASE. The directory traversal vulnerability in StringUtils.cleanPath() was fixed by the upstream Spring Framework team in May 2014 (commit 8ee4651038, addressing SPR-11793). The fix validates that extracted URI scheme prefixes don't contain forward slashes, preventing paths like \"/a/:b/../../etc/passwd\" from being misinterpreted. This fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:20:52.042688+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in Spring Framework 4.1.5 by replacing AlternativeJdkIdGenerator (which used predictable java.util.Random) with JdkIdGenerator (which uses cryptographically secure UUID.randomUUID()). The target version 4.3.20.RELEASE was released after 4.1.5 ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in Spring Framework 4.1.5 by replacing AlternativeJdkIdGenerator (which used predictable java.util.Random) with JdkIdGenerator (which uses cryptographically secure UUID.randomUUID()). The target version 4.3.20.RELEASE was released after 4.1.5 ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:11.896857+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 4.3.20.RELEASE. The upstream fix (commit 2bd1daa75e by Rossen Stoyanchev, October 2015) was introduced in Spring Framework 4.3.0.RC1 and is present in all subsequent 4.3.x releases including 4.3.20.RELEASE. All defense mechanisms are verified present: JSONP responses prefixed with \"/**/\", JSONP callback parameter validation with regex [0-9A-Za-z_\\.]*, path validation rejecting semicolons in filenames, and improved filename extraction stripping query/path parameters. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 4.3.20.RELEASE. The upstream fix (commit 2bd1daa75e by Rossen Stoyanchev, October 2015) was introduced in Spring Framework 4.3.0.RC1 and is present in all subsequent 4.3.x releases including 4.3.20.RELEASE. All defense mechanisms are verified present: JSONP responses prefixed with \"/**/\", JSONP callback parameter validation with regex [0-9A-Za-z_\\.]*, path validation rejecting semicolons in filenames, and improved filename extraction stripping query/path parameters. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:19:28.539186+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. The target Spring Framework 4.3.20.RELEASE is not affected by CVE-2016-5007. The vulnerability concerns pattern matching inconsistencies between Spring Security and Spring MVC that could lead to authorization bypass. The fix (commit a30ab30e4e - \"Introduce HandlerMapping introspection API\") was already present in the upstream Spring Framework 4.3.20.RELEASE when TuxCare onboarded it. The fix introduces MatchableHandlerMapping interface and HandlerMappingIntrospector class that expose Spring MVC's pattern matching logic, allowing Spring Security to use the same matching algorithm and preventing authorization bypass. Authored by Rossen Stoyanchev (upstream), this fix shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target Spring Framework 4.3.20.RELEASE is not affected by CVE-2016-5007. The vulnerability concerns pattern matching inconsistencies between Spring Security and Spring MVC that could lead to authorization bypass. The fix (commit a30ab30e4e - \"Introduce HandlerMapping introspection API\") was already present in the upstream Spring Framework 4.3.20.RELEASE when TuxCare onboarded it. The fix introduces MatchableHandlerMapping interface and HandlerMappingIntrospector class that expose Spring MVC's pattern matching logic, allowing Spring Security to use the same matching algorithm and preventing authorization bypass. Authored by Rossen Stoyanchev (upstream), this fix shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:43.517878+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework 4.3.x versions prior to 4.3.18. The target version 4.3.20.RELEASE includes the upstream fix that was released in v4.3.18.RELEASE. The fix changed the default JSONP parameter names from [\"jsonp\", \"callback\"] to an empty set, disabling JSONP support by default in MappingJackson2JsonView. Code analysis confirms the vulnerable pattern (auto-enabled JSONP via default parameter names) is not present. The fix was authored by upstream (Sebastien Deleuze, sdeleuze@pivotal.io) and shipped in the v4.3.20.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework 4.3.x versions prior to 4.3.18. The target version 4.3.20.RELEASE includes the upstream fix that was released in v4.3.18.RELEASE. The fix changed the default JSONP parameter names from [\"jsonp\", \"callback\"] to an empty set, disabling JSONP support by default in MappingJackson2JsonView. Code analysis confirms the vulnerable pattern (auto-enabled JSONP via default parameter names) is not present. The fix was authored by upstream (Sebastien Deleuze, sdeleuze@pivotal.io) and shipped in the v4.3.20.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:17:16.257271+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target version 4.3.20.RELEASE is not affected by CVE-2018-1199. The vulnerability (bypass of security constraints via un-normalized paths containing backslashes, duplicate slashes, or encoded characters) was fixed upstream in Spring Framework 4.3.15.RELEASE (April 2018) via issue SPR-16616. Since 4.3.20 >= 4.3.15, the onboarded upstream release already contained the complete fix. TuxCare ad...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target version 4.3.20.RELEASE is not affected by CVE-2018-1199. The vulnerability (bypass of security constraints via un-normalized paths containing backslashes, duplicate slashes, or encoded characters) was fixed upstream in Spring Framework 4.3.15.RELEASE (April 2018) via issue SPR-16616. Since 4.3.20 >= 4.3.15, the onboarded upstream release already contained the complete fix. TuxCare ad..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:52.088444+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the JDK-proxy exclusion that caused method resolution to skip the target class. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly into method resolution and resolves bridge methods. The lookup calls targetClass.getMethod without excluding JDK proxies at spring-core/src/main/java/org/springframework/util/ClassUtils.java:1186.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the JDK-proxy exclusion that caused method resolution to skip the target class. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly into method resolution and resolves bridge methods. The lookup calls targetClass.getMethod without excluding JDK proxies at spring-core/src/main/java/org/springframework/util/ClassUtils.java:1186."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:17:00.109182+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is NOT present in the target. The fix for directory traversal via encoded path sequences was included in upstream Spring Framework 4.3.20.RELEASE (commit b9ebdaaf3710db473a2e1fec8641c316483a22aa by Rossen Stoyanchev, dated 2018-03-21) before TuxCare onboarded this version. The target code contains the complete defense: isInvalidEncodedPath() methods in both ResourceHttpRequestHand...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is NOT present in the target. The fix for directory traversal via encoded path sequences was included in upstream Spring Framework 4.3.20.RELEASE (commit b9ebdaaf3710db473a2e1fec8641c316483a22aa by Rossen Stoyanchev, dated 2018-03-21) before TuxCare onboarded this version. The target code contains the complete defense: isInvalidEncodedPath() methods in both ResourceHttpRequestHand..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:46:23.146908+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 affects Spring Framework versions 4.3.x prior to 4.3.20. The target version is 4.3.20.RELEASE, which is the first fixed version for the 4.3.x line. The upstream fix (commit 044772641d1 by Rossen Stoyanchev) was already present in the upstream 4.3.20.RELEASE before TuxCare onboarded it. The fix adds two protections: (1) limits range requests to maximum 100 ranges, and (2) validates that overlapping ranges don't exceed the resource length. Both protections are present in the target code at spring-web/src/main/java/org/springframework/http/HttpRange.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 affects Spring Framework versions 4.3.x prior to 4.3.20. The target version is 4.3.20.RELEASE, which is the first fixed version for the 4.3.x line. The upstream fix (commit 044772641d1 by Rossen Stoyanchev) was already present in the upstream 4.3.20.RELEASE before TuxCare onboarded it. The fix adds two protections: (1) limits range requests to maximum 100 ranges, and (2) validates that overlapping ranges don't exceed the resource length. Both protections are present in the target code at spring-web/src/main/java/org/springframework/http/HttpRange.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T13:38:58.073079+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T03:39:22.988337+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T13:38:58.073079+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.20.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T13:37:36.186194+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-core."
    }
  ]
}