{
  "@id": "urn:uuid:3d6d3b82-4cb3-482b-af04-9a420ff3836a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:51:00.040518+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is a JDK vulnerability (Pattern.compile algorithmic complexity in JDK < 1.6) that was fixed in JDK 1.6 (December 2006). Spring Framework 4.3.21.RELEASE requires JDK 8+ as a documented prerequisite (README line 43), which includes the JDK fix. While Spring 4.3.21 retains the code paths that provide attack surface (HttpInvoker deserialization, PatternEditor property binding) and has...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is a JDK vulnerability (Pattern.compile algorithmic complexity in JDK < 1.6) that was fixed in JDK 1.6 (December 2006). Spring Framework 4.3.21.RELEASE requires JDK 8+ as a documented prerequisite (README line 43), which includes the JDK fix. While Spring 4.3.21 retains the code paths that provide attack surface (HttpInvoker deserialization, PatternEditor property binding) and has..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.21.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.21.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of proxy classes. The target version 4.3.21.RELEASE already contains the upstream fix (commit 7d8aa05c40 by jhoeller@vmware.com from July 2011) that was shipped in the upstream release before TuxCare onboarded it. All three affected files (ConfigurableObjectInputStream, RemoteInvocationSerializingExporter, CodebaseAwa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of proxy classes. The target version 4.3.21.RELEASE already contains the upstream fix (commit 7d8aa05c40 by jhoeller@vmware.com from July 2011) that was shipped in the upstream release before TuxCare onboarded it. All three affected files (ConfigurableObjectInputStream, RemoteInvocationSerializingExporter, CodebaseAwa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target version 4.3.21.RELEASE-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream Spring Framework release that TuxCare onboarded. The vulnerable code pattern (improper path prefix handling in StringUtils.cleanPath) does not exist in the target - it was fixed by upstream commit 8ee46510...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target version 4.3.21.RELEASE-tuxcare.3 is NOT vulnerable because the fix was already present in the upstream Spring Framework release that TuxCare onboarded. The vulnerable code pattern (improper path prefix handling in StringUtils.cleanPath) does not exist in the target - it was fixed by upstream commit 8ee46510..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target version 4.3.21.RELEASE is NOT AFFECTED because it inherited the upstream fix from version 4.1.5 (released Feb 2015). The fix replaced the insecure AlternativeJdkIdGenerator (which used java.util.Random after initial SecureRandom seed) with JdkIdGenerator (whic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target version 4.3.21.RELEASE is NOT AFFECTED because it inherited the upstream fix from version 4.1.5 (released Feb 2015). The fix replaced the insecure AlternativeJdkIdGenerator (which used java.util.Random after initial SecureRandom seed) with JdkIdGenerator (whic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. Spring Framework 4.3.21.RELEASE is not affected by CVE-2015-5211 (Reflected File Download attack). The upstream fix was introduced in Spring Framework v4.2.2.RELEASE (October 2015) by Rossen Stoyanchev from the Pivotal/Spring team and was already present in the upstream release before TuxCare onboarded version 4.3.21.RELEASE. All defensive patches are present in the target code: WebUtils.extractFullFilenameFromUrlPath() properly strips query/path parameters before extracting file extensions, MappingJackson2HttpMessageConverter adds the /*...*/ prefix to JSONP responses to break batch script syntax, and PathExtensionContentNegotiationStrategy restricts JAF-based MIME type resolution. The vulnerable pattern described in the CVE has been removed by the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 4.3.21.RELEASE is not affected by CVE-2015-5211 (Reflected File Download attack). The upstream fix was introduced in Spring Framework v4.2.2.RELEASE (October 2015) by Rossen Stoyanchev from the Pivotal/Spring team and was already present in the upstream release before TuxCare onboarded version 4.3.21.RELEASE. All defensive patches are present in the target code: WebUtils.extractFullFilenameFromUrlPath() properly strips query/path parameters before extracting file extensions, MappingJackson2HttpMessageConverter adds the /*...*/ prefix to JSONP responses to break batch script syntax, and PathExtensionContentNegotiationStrategy restricts JAF-based MIME type resolution. The vulnerable pattern described in the CVE has been removed by the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. CVE-2016-5007 describes an authorization bypass vulnerability caused by pattern-matching inconsistencies between Spring Security and Spring MVC. The upstream fix (commit a30ab30e4e, SPR-14321) introduces a HandlerMapping introspection API that allows external authorization systems to use the same path-matching logic as Spring MVC's routing system. This fix was shipped in Spring Framework v4.3.1.RELEASE (April 2016). The target repository is at version 4.3.21.RELEASE, which is 20 patch releases after the fix was introduced. All required components are present: MatchableHandlerMapping interface, HandlerMappingIntrospector class, and implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The fix was authored by upstream Spring developers (rstoyanchev@pivotal.io) and was already included in the upstream release that TuxCare onboarded. Therefore, the vulnerable pattern (lack of consistent matching API) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 describes an authorization bypass vulnerability caused by pattern-matching inconsistencies between Spring Security and Spring MVC. The upstream fix (commit a30ab30e4e, SPR-14321) introduces a HandlerMapping introspection API that allows external authorization systems to use the same path-matching logic as Spring MVC's routing system. This fix was shipped in Spring Framework v4.3.1.RELEASE (April 2016). The target repository is at version 4.3.21.RELEASE, which is 20 patch releases after the fix was introduced. All required components are present: MatchableHandlerMapping interface, HandlerMappingIntrospector class, and implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The fix was authored by upstream Spring developers (rstoyanchev@pivotal.io) and was already included in the upstream release that TuxCare onboarded. Therefore, the vulnerable pattern (lack of consistent matching API) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. Target version 4.3.21.RELEASE is not affected by CVE-2018-11040. The vulnerability (automatic enablement of JSONP via default parameter names \"jsonp\" and \"callback\" in MappingJackson2JsonView) was fixed in upstream Spring Framework 4.3.18. The target version 4.3.21.RELEASE already contains the upstream fix, which was shipped in the upstream release before TuxCare onboarded it. The fix initializes jsonpParameterNames as an empty set, requiring explicit developer configuration to enable JSONP functionality.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Target version 4.3.21.RELEASE is not affected by CVE-2018-11040. The vulnerability (automatic enablement of JSONP via default parameter names \"jsonp\" and \"callback\" in MappingJackson2JsonView) was fixed in upstream Spring Framework 4.3.18. The target version 4.3.21.RELEASE already contains the upstream fix, which was shipped in the upstream release before TuxCare onboarded it. The fix initializes jsonpParameterNames as an empty set, requiring explicit developer configuration to enable JSONP functionality.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 4.3.21.RELEASE is NOT affected by CVE-2018-1199. The vulnerability affected Spring Framework 4.3.x before 4.3.14, but this version (4.3.21) already contains the upstream fixes from SPR-16616 that address the path traversal vulnerability. The fixes were shipped in the upstream 4.3.14+ releases and are present in the 4.3.21.RELEASE that TuxCare onboarded. The vulnerabl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 4.3.21.RELEASE is NOT affected by CVE-2018-1199. The vulnerability affected Spring Framework 4.3.x before 4.3.14, but this version (4.3.21) already contains the upstream fixes from SPR-16616 that address the path traversal vulnerability. The fixes were shipped in the upstream 4.3.14+ releases and are present in the 4.3.21.RELEASE that TuxCare onboarded. The vulnerabl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework 4.3.x prior to 4.3.17. The target is version 4.3.21.RELEASE, which already contains the upstream fix (commit 246a6db1ca) that shipped with Spring Framework 4.3.17. The fix allows disabling the selector header feature entirely by setting the header name to null, preventing malicious Spring EL expressions from being parsed. The vulnerable pattern (mandatory ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework 4.3.x prior to 4.3.17. The target is version 4.3.21.RELEASE, which already contains the upstream fix (commit 246a6db1ca) that shipped with Spring Framework 4.3.17. The fix allows disabling the selector header feature entirely by setting the header name to null, preventing malicious Spring EL expressions from being parsed. The vulnerable pattern (mandatory ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:52.088444+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the method-resolution regression is absent. The code passes the target class directly to method resolution and resolves bridge methods in spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190. Annotation matching checks the invoked method first, then the resolved target method, in spring-aop/src/main/java/org/springframework/aop/support/annotation/AnnotationMethodMatcher.java:51.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the method-resolution regression is absent. The code passes the target class directly to method resolution and resolves bridge methods in spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190. Annotation matching checks the invoked method first, then the resolved target method, in spring-aop/src/main/java/org/springframework/aop/support/annotation/AnnotationMethodMatcher.java:51."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 4.3.21.RELEASE. The vulnerability affected versions prior to 4.3.15, involving a flawed directory traversal check in PathResourceResolver.isInvalidEncodedPath(). The target contains the proper fix (checking for \"../\" or \"..\\\\\" in decoded paths) which was included in the upstream 4.3.21 release by Spring Framework maintainer Juergen Hoeller on 201...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 4.3.21.RELEASE. The vulnerability affected versions prior to 4.3.15, involving a flawed directory traversal check in PathResourceResolver.isInvalidEncodedPath(). The target contains the proper fix (checking for \"../\" or \"..\\\\\" in decoded paths) which was included in the upstream 4.3.21 release by Spring Framework maintainer Juergen Hoeller on 201..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. The target Spring Framework version 4.3.21.RELEASE is NOT affected by CVE-2018-15756. The fix for this DoS vulnerability (malicious HTTP Range headers) was already present in the upstream v4.3.21.RELEASE release that TuxCare onboarded. The CVE states that versions prior to 4.3.20 are affected; 4.3.21 is after the fix cutoff. Both required defenses are present in HttpRange.java: (1) MAX_RANGES=100 validation at line 147, and (2) sum-of-ranges validation at lines 195-203. The fix was authored by upstream Spring maintainer rstoyanchev@pivotal.io in commit 044772641d, which shipped in v4.3.20.RELEASE and v4.3.21.RELEASE tags before TuxCare's onboarding merge 123e523e84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework version 4.3.21.RELEASE is NOT affected by CVE-2018-15756. The fix for this DoS vulnerability (malicious HTTP Range headers) was already present in the upstream v4.3.21.RELEASE release that TuxCare onboarded. The CVE states that versions prior to 4.3.20 are affected; 4.3.21 is after the fix cutoff. Both required defenses are present in HttpRange.java: (1) MAX_RANGES=100 validation at line 147, and (2) sum-of-ranges validation at lines 195-203. The fix was authored by upstream Spring maintainer rstoyanchev@pivotal.io in commit 044772641d, which shipped in v4.3.20.RELEASE and v4.3.21.RELEASE tags before TuxCare's onboarding merge 123e523e84.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-10T04:24:16.758339+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the vulnerable cached-URI comparison that treats a request URI as a regular expression. Handler lookup queries mappings directly at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:119. The same file at lines 135 and 207 confirms there is no CachedResult, cache filter, or vulnerable URI comparison.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the vulnerable cached-URI comparison that treats a request URI as a regular expression. Handler lookup queries mappings directly at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:119. The same file at lines 135 and 207 confirms there is no CachedResult, cache filter, or vulnerable URI comparison."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.21.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:43.070560+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.21.RELEASE-tuxcare.5 of org.springframework:spring-core."
    }
  ]
}