{
  "@id": "urn:uuid:ea518fcf-69d3-4b19-82b1-91d76631b5ed",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T11:58:13.297730+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in Java's Pattern.compile method that affects \"JDK before 1.6\" when used with Spring Framework versions 1.1.0-2.5.6 and 3.0.0.M1-M2. The target version (Spring 4.3.26.RELEASE) is well beyond the affected Spring version range and requires JDK 8 to run (per README: \"JDK 8 update 20 or later\"). Since JDK 8 includes all fixes from JDK 1.6+, t...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in Java's Pattern.compile method that affects \"JDK before 1.6\" when used with Spring Framework versions 1.1.0-2.5.6 and 3.0.0.M1-M2. The target version (Spring 4.3.26.RELEASE) is well beyond the affected Spring version range and requires JDK 8 to run (per README: \"JDK 8 update 20 or later\"). Since JDK 8 includes all fixes from JDK 1.6+, t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:28:28.319057+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.26.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.26.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:32:23.443059+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 4.3.26.RELEASE is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes with InvocationHandler) was fixed in Spring Framework 3.0.6.RELEASE (July 2011) by upstream author Juergen Hoeller. The fix was already present in the upstream 4.3.26.RELEASE when TuxCare onboarded it in 2020. The target code contains the acceptProxyClasses protection mec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 4.3.26.RELEASE is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes with InvocationHandler) was fixed in Spring Framework 3.0.6.RELEASE (July 2011) by upstream author Juergen Hoeller. The fix was already present in the upstream 4.3.26.RELEASE when TuxCare onboarded it in 2020. The target code contains the acceptProxyClasses protection mec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 4.3.26.RELEASE-tuxcare.3. The directory traversal vulnerability in StringUtils.cleanPath() was fixed in upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (May 15, 2014) which shipped in the 4.3.26.RELEASE version that TuxCare onboarded. The fix adds validation to reject path prefixes containing \"/\" characters, preventing crafted URLs like ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 4.3.26.RELEASE-tuxcare.3. The directory traversal vulnerability in StringUtils.cleanPath() was fixed in upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (May 15, 2014) which shipped in the 4.3.26.RELEASE version that TuxCare onboarded. The fix adds validation to reject path prefixes containing \"/\" characters, preventing crafted URLs like ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:46.375124+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The vulnerability was fixed in commit 52b8f34468 (upstream, Jan 2015) by replacing AlternativeJdkIdGenerator (which used predictable java.util.Random) with JdkIdGenerator (which uses cryptographically secure UUID.randomUUID()). The target version 4.3.26.RELEASE already contai...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The vulnerability was fixed in commit 52b8f34468 (upstream, Jan 2015) by replacing AlternativeJdkIdGenerator (which used predictable java.util.Random) with JdkIdGenerator (which uses cryptographically secure UUID.randomUUID()). The target version 4.3.26.RELEASE already contai..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:53:41.382779+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 4.3.26.RELEASE. The upstream vendor (Pivotal/Spring) fixed this vulnerability in October 2015 (commit 2bd1daa75e) before the 4.3.26.RELEASE version was published. The fix was already included when TuxCare onboarded this version. All RFD defenses are present and functional: Content-Disposition header protection, extension whitelisting, JSONP callback validation, and proper path parameter handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 4.3.26.RELEASE. The upstream vendor (Pivotal/Spring) fixed this vulnerability in October 2015 (commit 2bd1daa75e) before the 4.3.26.RELEASE version was published. The fix was already included when TuxCare onboarded this version. All RFD defenses are present and functional: Content-Disposition header protection, extension whitelisting, JSONP callback validation, and proper path parameter handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:06:45.482707+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 describes pattern-matching inconsistencies between Spring Security authorization and Spring MVC routing that allow bypassing security checks. The vulnerability in Spring Framework was the absence of a standardized API for authorization systems to query routing's pattern-matching logic. Spring Framework 4.3.1 (July 2016) introduced the fix via commit a30ab30e4e, adding MatchableHandlerMapping interface, HandlerMappingIntrospector helper, and match() methods on AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The target version 4.3.26.RELEASE (January 2020) includes this fix from the upstream release. The vulnerable pattern (no pattern-matching introspection API) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 describes pattern-matching inconsistencies between Spring Security authorization and Spring MVC routing that allow bypassing security checks. The vulnerability in Spring Framework was the absence of a standardized API for authorization systems to query routing's pattern-matching logic. Spring Framework 4.3.1 (July 2016) introduced the fix via commit a30ab30e4e, adding MatchableHandlerMapping interface, HandlerMappingIntrospector helper, and match() methods on AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The target version 4.3.26.RELEASE (January 2020) includes this fix from the upstream release. The vulnerable pattern (no pattern-matching introspection API) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:07.796693+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-11040 does not affect this target. The vulnerability concerned automatic JSONP enablement via default parameter names (\"jsonp\" and \"callback\") in MappingJackson2JsonView. The fix (commit 874859493b by upstream author sdeleuze@pivotal.io) was already present in upstream Spring Framework v4.3.26.RELEASE when TuxCare onboarded it. The target code at line 89 of MappingJackson2JsonView.java initializes jsonpParameterNames as an empty LinkedHashSet, requiring explicit configuration to enable JSONP. This is the fixed state, not the vulnerable state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 does not affect this target. The vulnerability concerned automatic JSONP enablement via default parameter names (\"jsonp\" and \"callback\") in MappingJackson2JsonView. The fix (commit 874859493b by upstream author sdeleuze@pivotal.io) was already present in upstream Spring Framework v4.3.26.RELEASE when TuxCare onboarded it. The target code at line 89 of MappingJackson2JsonView.java initializes jsonpParameterNames as an empty LinkedHashSet, requiring explicit configuration to enable JSONP. This is the fixed state, not the vulnerable state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T00:50:03.356713+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target Spring Framework 4.3.26.RELEASE already contains the complete upstream fix for CVE-2018-1199 (SPR-16616). The vulnerability allowed bypassing security constraints via specially-encoded URL path parameters. The fix adds path normalization (removing duplicate slashes, replacing backslashes) and validation (checking for encoded path traversal sequences \"../\" and \"..\\\\\" after URL decoding). ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Target Spring Framework 4.3.26.RELEASE already contains the complete upstream fix for CVE-2018-1199 (SPR-16616). The vulnerability allowed bypassing security constraints via specially-encoded URL path parameters. The fix adds path normalization (removing duplicate slashes, replacing backslashes) and validation (checking for encoded path traversal sequences \"../\" and \"..\\\\\" after URL decoding). ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T08:55:17.845672+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 4.3.26.RELEASE. The vulnerability affected versions prior to 4.3.17, and the fix was already included in the upstream 4.3.26.RELEASE that TuxCare onboarded. The fix (commit 246a6db1ca by Rossen Stoyanchev) allows administrators to disable selector header processing by setting selectorHeaderName to null, preventing ReDoS attacks via malicious Spri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 4.3.26.RELEASE. The vulnerability affected versions prior to 4.3.17, and the fix was already included in the upstream 4.3.26.RELEASE that TuxCare onboarded. The fix (commit 246a6db1ca by Rossen Stoyanchev) allows administrators to disable selector header processing by setting selectorHeaderName to null, preventing ReDoS attacks via malicious Spri..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:20:04.842645+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the defective exclusion of dynamic proxy classes from method resolution is absent. In spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190, the resolver uses the target class directly and resolves bridge methods; both static and runtime matching use this helper in spring-aop/src/main/java/org/springframework/aop/aspectj/AspectJExpressionPointcut.java:278 and :318.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the defective exclusion of dynamic proxy classes from method resolution is absent. In spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190, the resolver uses the target class directly and resolves bridge methods; both static and runtime matching use this helper in spring-aop/src/main/java/org/springframework/aop/aspectj/AspectJExpressionPointcut.java:278 and :318."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:22:00.126197+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 4.3.26.RELEASE is NOT vulnerable to CVE-2018-1271 (directory traversal via URL-encoded path sequences on Windows). The vulnerability was fixed in upstream Spring Framework 4.3.15.RELEASE (April 2018), and the target version 4.3.26.RELEASE (January 2020) was released well after the fix. The complete mitigation is present in HEAD: (1) isInvalidEncodedPath() method that...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 4.3.26.RELEASE is NOT vulnerable to CVE-2018-1271 (directory traversal via URL-encoded path sequences on Windows). The vulnerability was fixed in upstream Spring Framework 4.3.15.RELEASE (April 2018), and the target version 4.3.26.RELEASE (January 2020) was released well after the fix. The complete mitigation is present in HEAD: (1) isInvalidEncodedPath() method that..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:30:30.768655+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 4.3.26.RELEASE is not affected by CVE-2018-15756. The vulnerability fix was already present in the upstream Spring Framework release that TuxCare onboarded. The fix adds validation to HttpRange.parseRanges() limiting ranges to 100 max and validates in toResourceRegions() that the sum of range lengths is less than the resource length, preventing DoS attacks via malicious Range headers. Fix commit 044772641d by rstoyanchev@pivotal.io shipped in upstream v4.3.20.RELEASE (CVE states versions prior to 4.3.20 are affected). Target version 4.3.26.RELEASE includes this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 4.3.26.RELEASE is not affected by CVE-2018-15756. The vulnerability fix was already present in the upstream Spring Framework release that TuxCare onboarded. The fix adds validation to HttpRange.parseRanges() limiting ranges to 100 max and validates in toResourceRegions() that the sum of range lengths is less than the resource length, preventing DoS attacks via malicious Range headers. Fix commit 044772641d by rstoyanchev@pivotal.io shipped in upstream v4.3.20.RELEASE (CVE states versions prior to 4.3.20 are affected). Target version 4.3.26.RELEASE includes this fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T11:29:50.472099+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 4.3.26.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 4.3.26.RELEASE-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:31.962159+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the vulnerable cached URI comparison that interprets request text as a regular expression. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:119, handler lookup iterates mappings directly, skips null handlers, and returns null when none matches; the class has no CachedResult or cached URI regex comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the vulnerable cached URI comparison that interprets request text as a regular expression. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:119, handler lookup iterates mappings directly, skips null handlers, and returns null when none matches; the class has no CachedResult or cached URI regex comparison."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:53:08.597901+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.26.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:53:08.597901+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-core."
    }
  ]
}