{
  "@id": "urn:uuid:504476aa-be3f-44d6-a107-1c970ce7d8e9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:51:00.040518+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:38:02.053506+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 does not affect Spring Framework 4.3.4.RELEASE. The vulnerability required a readObject method in AbstractRegexpMethodPointcut that recompiled regex patterns from deserialized strings, allowing DoS attacks via catastrophic backtracking. This vulnerable code was removed in commit 9306d6dbaabe21f50000406a3db982756297bce5 (April 2009) by upstream author jhoeller@vmware.com. The fix c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 does not affect Spring Framework 4.3.4.RELEASE. The vulnerability required a readObject method in AbstractRegexpMethodPointcut that recompiled regex patterns from deserialized strings, allowing DoS attacks via catastrophic backtracking. This vulnerable code was removed in commit 9306d6dbaabe21f50000406a3db982756297bce5 (April 2009) by upstream author jhoeller@vmware.com. The fix c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:37:00.050625+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.4.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.4.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:45:17.985105+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 is NOT present in Spring Framework 4.3.4.RELEASE. The vulnerability affected Spring Framework 3.0.0-3.0.5, which lacked protection against malicious deserialization of proxy classes. The fix (adding acceptProxyClasses flag and NotSerializableException check in ConfigurableObjectInputStream.resolveProxyClass) was introduced by upstream Spring in commit 7d8aa05c40 (July 2011) and re...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is NOT present in Spring Framework 4.3.4.RELEASE. The vulnerability affected Spring Framework 3.0.0-3.0.5, which lacked protection against malicious deserialization of proxy classes. The fix (adding acceptProxyClasses flag and NotSerializableException check in ConfigurableObjectInputStream.resolveProxyClass) was introduced by upstream Spring in commit 7d8aa05c40 (July 2011) and re..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 4.3.4.RELEASE. The vulnerability was fixed by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (author: rstoyanchev@gopivotal.com) before this version was released. The fix adds validation to StringUtils.cleanPath() to reject pseudo-URL-scheme patterns (colon-prefixed segments containing slashes), preventing directory traversal attacks. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 4.3.4.RELEASE. The vulnerability was fixed by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (author: rstoyanchev@gopivotal.com) before this version was released. The fix adds validation to StringUtils.cleanPath() to reject pseudo-URL-scheme patterns (colon-prefixed segments containing slashes), preventing directory traversal attacks. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:12:30.660956+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5. The vulnerability involved predictable session ID generation in the SockJS Java client, which used AlternativeJdkIdGenerator (SecureRandom only for initial seed, then predictable Random). The fix replaced it with JdkIdGenerator using UUID.randomUUID() (fully SecureRandom). Target version 4.3.4.RELEASE already contains this upstream fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5. The vulnerability involved predictable session ID generation in the SockJS Java client, which used AlternativeJdkIdGenerator (SecureRandom only for initial seed, then predictable Random). The fix replaced it with JdkIdGenerator using UUID.randomUUID() (fully SecureRandom). Target version 4.3.4.RELEASE already contains this upstream fix ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). The CVE affects versions 4.2.0-4.2.1, 4.0.0-4.1.7, and 3.2.0-3.2.14. The RFD fix (commit 2bd1daa75e) was committed on October 4, 2015 and included in Spring Framework 4.3.0.RELEASE (June 2016), before 4.3.4.RELEASE (November 2016). All RFD defenses are present in the target: Content-Disposition header protection in AbstractMessageConverterMethodProcessor, path parameter sanitization in WebUtils, JSONP callback validation, and SockJS path validation. The fix was part of the upstream release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). The CVE affects versions 4.2.0-4.2.1, 4.0.0-4.1.7, and 3.2.0-3.2.14. The RFD fix (commit 2bd1daa75e) was committed on October 4, 2015 and included in Spring Framework 4.3.0.RELEASE (June 2016), before 4.3.4.RELEASE (November 2016). All RFD defenses are present in the target: Content-Disposition header protection in AbstractMessageConverterMethodProcessor, path parameter sanitization in WebUtils, JSONP callback validation, and SockJS path validation. The fix was part of the upstream release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:15:34.961054+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2016-5007. The vulnerability affects versions 3.2.x, 4.0.x, 4.1.x, and 4.2.x due to inconsistent URL pattern matching between Spring Security and Spring MVC. The fix (HandlerMappingIntrospector API) was introduced by upstream Spring in commit a30ab30e4e on April 25, 2016 and included in Spring Framework 4.3.1.RELEASE (July 4, 2016). The target version 4.3.4.RELEASE shipped with this fix already present, so the vulnerable code pattern never existed in this version. The fix was authored by Rossen Stoyanchev from Pivotal/Spring, not TuxCare, and is an ancestor of the first TuxCare commit (09823dcb7 \"Onboard version 4.3.4.RELEASE\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2016-5007. The vulnerability affects versions 3.2.x, 4.0.x, 4.1.x, and 4.2.x due to inconsistent URL pattern matching between Spring Security and Spring MVC. The fix (HandlerMappingIntrospector API) was introduced by upstream Spring in commit a30ab30e4e on April 25, 2016 and included in Spring Framework 4.3.1.RELEASE (July 4, 2016). The target version 4.3.4.RELEASE shipped with this fix already present, so the vulnerable code pattern never existed in this version. The fix was authored by Rossen Stoyanchev from Pivotal/Spring, not TuxCare, and is an ancestor of the first TuxCare commit (09823dcb7 \"Onboard version 4.3.4.RELEASE\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 4.3.4.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "action_statement": "Vulnerability CVE-2018-1257 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 4.3.4.RELEASE-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:00.444930+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the proxy-exclusion regression in method resolution is absent. Method resolution passes the actual target class and then resolves bridge methods (spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190), while public interface methods are resolved through targetClass.getMethod (spring-core/src/main/java/org/springframework/util/ClassUtils.java:776).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the proxy-exclusion regression in method resolution is absent. Method resolution passes the actual target class and then resolves bridge methods (spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190), while public interface methods are resolved through targetClass.getMethod (spring-core/src/main/java/org/springframework/util/ClassUtils.java:776)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1271"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 4.3.4.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 4.3.4.RELEASE-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 is fixed in version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 4.3.4.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 4.3.4.RELEASE-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-core."
    }
  ]
}