{
  "@id": "urn:uuid:6f3f8d87-e3d8-47b9-8ade-b0cf7e0d109a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:52:00.326096+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes a deserialization DoS vulnerability where malicious serialized data containing complex regex patterns would trigger catastrophic backtracking in Pattern.compile() during object deserialization. The vulnerability was fixed by upstream Spring Framework in commit 9306d6dbaa (April 20, 2009) which removed the readObject() method that re-compiled patterns during deserializati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes a deserialization DoS vulnerability where malicious serialized data containing complex regex patterns would trigger catastrophic backtracking in Pattern.compile() during object deserialization. The vulnerability was fixed by upstream Spring Framework in commit 9306d6dbaa (April 20, 2009) which removed the readObject() method that re-compiled patterns during deserializati..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:04.386984+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.27.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.27.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:52:00.073904+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0 through 3.0.5 and was fixed in version 3.0.6 (July 2011). The target repository is Spring Framework 4.3.27.RELEASE (2020), which inherently includes the upstream fix. All three patched files contain the complete defense mechanism (acceptProxyClasses flag with NotSerializableException check). The fix was authored by upstream (Juergen Hoeller, VMware) ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0 through 3.0.5 and was fixed in version 3.0.6 (July 2011). The target repository is Spring Framework 4.3.27.RELEASE (2020), which inherently includes the upstream fix. All three patched files contain the complete defense mechanism (acceptProxyClasses flag with NotSerializableException check). The fix was authored by upstream (Juergen Hoeller, VMware) ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 4.3.27.RELEASE. The fix was already included in the upstream release that TuxCare onboarded. The vulnerability allowed attackers to use crafted paths like `/a:b/../../file` to traverse directories by exploiting improper URI scheme prefix extraction. The fix (commit 8ee4651038 by upstream author rstoyanchev@gopivo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 4.3.27.RELEASE. The fix was already included in the upstream release that TuxCare onboarded. The vulnerability allowed attackers to use crafted paths like `/a:b/../../file` to traverse directories by exploiting improper URI scheme prefix extraction. The fix (commit 8ee4651038 by upstream author rstoyanchev@gopivo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:19:36.318385+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used SecureRandom only for initial seed, then predictable java.util.Random). The vulnerability was fixed in upstream commit d63cfc8eeb (Jan 2015) by switching to JdkIdGenerator which uses UUID.randomUUID() for cryptographically secure se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used SecureRandom only for initial seed, then predictable java.util.Random). The vulnerability was fixed in upstream commit d63cfc8eeb (Jan 2015) by switching to JdkIdGenerator which uses UUID.randomUUID() for cryptographically secure se..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:56.260651+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. Spring Framework 4.3.27.RELEASE is not affected by CVE-2015-5211 (Reflected File Download exploit). The vulnerability was fixed in upstream Spring Framework 4.2.2.RELEASE (October 2015) via commit 2bd1daa75e authored by Rossen Stoyanchev. The target version 4.3.27.RELEASE already contains all three RFD protections from the upstream fix: Content-Disposition header enforcement for unsafe file extensions, path parameter inspection to detect obfuscated extensions, and JSONP callback validation. The vulnerable code pattern is not present because the fix shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 4.3.27.RELEASE is not affected by CVE-2015-5211 (Reflected File Download exploit). The vulnerability was fixed in upstream Spring Framework 4.2.2.RELEASE (October 2015) via commit 2bd1daa75e authored by Rossen Stoyanchev. The target version 4.3.27.RELEASE already contains all three RFD protections from the upstream fix: Content-Disposition header enforcement for unsafe file extensions, path parameter inspection to detect obfuscated extensions, and JSONP callback validation. The vulnerable code pattern is not present because the fix shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:59.012677+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 4.3.27.RELEASE. The vulnerability concerned pattern matching inconsistencies between Spring Security (authorization) and Spring MVC (controller routing) that could allow authorization bypasses. The upstream fix introduced a HandlerMappingIntrospector API with MatchableHandlerMapping interface in Spring Framework 4.3.1 (commit a30ab30e4e, April 2016) to provide unified pattern matching. This fix is present in the target (4.3.27.RELEASE) as it was shipped in the upstream release, not backported by TuxCare. All key components are implemented: MatchableHandlerMapping interface, HandlerMappingIntrospector helper, RequestMatchResult class, and match() implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 4.3.27.RELEASE. The vulnerability concerned pattern matching inconsistencies between Spring Security (authorization) and Spring MVC (controller routing) that could allow authorization bypasses. The upstream fix introduced a HandlerMappingIntrospector API with MatchableHandlerMapping interface in Spring Framework 4.3.1 (commit a30ab30e4e, April 2016) to provide unified pattern matching. This fix is present in the target (4.3.27.RELEASE) as it was shipped in the upstream release, not backported by TuxCare. All key components are implemented: MatchableHandlerMapping interface, HandlerMappingIntrospector helper, RequestMatchResult class, and match() implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:00:11.067776+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. The target version 4.3.27.RELEASE already contains the upstream fix for CVE-2018-11040. The vulnerability involved automatic JSONP support in MappingJackson2JsonView through default query parameter names \"jsonp\" and \"callback\", enabling cross-domain data exfiltration. The upstream fix (commit 874859493b by Sebastien Deleuze) disabled JSONP by default by clearing the jsonpParameterNames set to empty. This fix was shipped in upstream release 4.3.27.RELEASE (which is >= 4.3.18, the first fixed version) before TuxCare onboarded it, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target version 4.3.27.RELEASE already contains the upstream fix for CVE-2018-11040. The vulnerability involved automatic JSONP support in MappingJackson2JsonView through default query parameter names \"jsonp\" and \"callback\", enabling cross-domain data exfiltration. The upstream fix (commit 874859493b by Sebastien Deleuze) disabled JSONP by default by clearing the jsonpParameterNames set to empty. This fix was shipped in upstream release 4.3.27.RELEASE (which is >= 4.3.18, the first fixed version) before TuxCare onboarded it, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:15:16.880365+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework 4.3.x before 4.3.14. The target is version 4.3.27.RELEASE, which already contains the upstream fix (commit b9ebdaaf37) that normalizes resource request paths before validation. The fix removes duplicate slashes, converts backslashes to forward slashes, and validates URL-decoded paths for traversal sequences, preventing bypass of security constraints via sp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework 4.3.x before 4.3.14. The target is version 4.3.27.RELEASE, which already contains the upstream fix (commit b9ebdaaf37) that normalizes resource request paths before validation. The fix removes duplicate slashes, converts backslashes to forward slashes, and validates URL-decoded paths for traversal sequences, preventing bypass of security constraints via sp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 (ReDoS via STOMP selector header) is NOT present in spring-framework 4.3.27.RELEASE. The upstream fix from commit 246a6db1ca (authored by rstoyanchev@pivotal.io, April 2018) shipped in the upstream 4.3.27.RELEASE before TuxCare onboarded it. The fix adds a null check before parsing selector expressions, preventing malicious SpEL expressions from being unconditionally evaluated.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 (ReDoS via STOMP selector header) is NOT present in spring-framework 4.3.27.RELEASE. The upstream fix from commit 246a6db1ca (authored by rstoyanchev@pivotal.io, April 2018) shipped in the upstream 4.3.27.RELEASE before TuxCare onboarded it. The fix adds a null check before parsing selector expressions, preventing malicious SpEL expressions from being unconditionally evaluated."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:00.444930+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the regression that discards JDK proxy target classes is absent. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly to method resolution and resolves bridge methods; spring-core/src/main/java/org/springframework/core/annotation/AnnotationUtils.java:571 searches interfaces after resolving bridges.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the regression that discards JDK proxy target classes is absent. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly to method resolution and resolves bridge methods; spring-core/src/main/java/org/springframework/core/annotation/AnnotationUtils.java:571 searches interfaces after resolving bridges."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:00.117091+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 4.3 prior to 4.3.15. The target is version 4.3.27.RELEASE, which already contains the upstream fix (commit f046a066ec by jhoeller@pivotal.io). The isInvalidEncodedPath() defense method is present in both PathResourceResolver (lines 284-301) and ResourceHttpRequestHandler (lines 627-648), blocking URL-encoded directory traversal sequences (../ and ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 4.3 prior to 4.3.15. The target is version 4.3.27.RELEASE, which already contains the upstream fix (commit f046a066ec by jhoeller@pivotal.io). The isInvalidEncodedPath() defense method is present in both PathResourceResolver (lines 284-301) and ResourceHttpRequestHandler (lines 627-648), blocking URL-encoded directory traversal sequences (../ and ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:25:11.687376+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:44:14.640121+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 (Spring Framework Range Request DoS) is NOT present in Spring Framework 4.3.27.RELEASE. The fix was already included in the upstream release. The target repository contains the necessary defenses: MAX_RANGES=100 limit (line 134-136) and overlapping range sum validation (lines 189-192) in HttpRange.java. Fix commit 044772641d by upstream author rstoyanchev@pivotal.io predates the TuxCare onboarding commit cf1ffa245c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 (Spring Framework Range Request DoS) is NOT present in Spring Framework 4.3.27.RELEASE. The fix was already included in the upstream release. The target repository contains the necessary defenses: MAX_RANGES=100 limit (line 134-136) and overlapping range sum validation (lines 189-192) in HttpRange.java. Fix commit 044772641d by upstream author rstoyanchev@pivotal.io predates the TuxCare onboarding commit cf1ffa245c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T17:44:21.847091+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.27.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.27.RELEASE-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:24:16.758339+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached URI comparison code is absent. The implementation directly iterates handler mappings at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:119, and the class contains no CachedResult or URI regular-expression matching path through its end at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:207.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached URI comparison code is absent. The implementation directly iterates handler mappings at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:119, and the class contains no CachedResult or URI regular-expression matching path through its end at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:207."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:43:00.288544+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.27.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T16:41:00.167866+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-core."
    }
  ]
}