{ "@id": "urn:uuid:eb044102-2827-4ae4-a2ef-123c32b413d6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 35, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:24:00.586682+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T12:48:12.312716+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is a JDK vulnerability in Pattern.compile() affecting JDK versions before 1.6. Spring Framework 4.3.9.RELEASE requires minimum Java SE 6 for runtime (documented in whats-new.adoc), which includes fixes for the underlying algorithmic complexity issue. While PatternEditor still calls Pattern.compile() without input validation, the exploitation requires JDK before 1.6 - an environmen...", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 CVE-2009-1190 is a JDK vulnerability in Pattern.compile() affecting JDK versions before 1.6. Spring Framework 4.3.9.RELEASE requires minimum Java SE 6 for runtime (documented in whats-new.adoc), which includes fixes for the underlying algorithmic complexity issue. While PatternEditor still calls Pattern.compile() without input validation, the exploitation requires JDK before 1.6 - an environmen..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T17:39:00.028214+00:00", "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.9.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2730" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.9.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T09:49:00.106689+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 (unsafe deserialization of proxy classes). Target version 4.3.9.RELEASE contains the upstream fix (acceptProxyClasses flag mechanism) introduced in v3.0.6.RELEASE by Juergen Hoeller (jhoeller@vmware.com). The fix was already present when TuxCare onboarded 4.3.9.RELEASE. Defense code exists in ConfigurableObjectInputStream.resolveProxyClass() (t...", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 (unsafe deserialization of proxy classes). Target version 4.3.9.RELEASE contains the upstream fix (acceptProxyClasses flag mechanism) introduced in v3.0.6.RELEASE by Juergen Hoeller (jhoeller@vmware.com). The fix was already present when TuxCare onboarded 4.3.9.RELEASE. Defense code exists in ConfigurableObjectInputStream.resolveProxyClass() (t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 4.3.9.RELEASE. The fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66 from May 15, 2014) was already included in the upstream release when Pivotal shipped it. The vulnerable code pattern does not exist - StringUtils.cleanPath() correctly rejects path segments containing both ':' and '/' from being treated as va...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3578" }, "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 4.3.9.RELEASE. The fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66 from May 15, 2014) was already included in the upstream release when Pivotal shipped it. The vulnerable code pattern does not exist - StringUtils.cleanPath() correctly rejects path segments containing both ':' and '/' from being treated as va..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T19:15:14.075619+00:00", "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client used AlternativeJdkIdGenerator for session IDs - which employs SecureRandom only for initial seeding, then uses predictable java.util.Random thereafter. The target version 4.3.9.RELEASE contains the upstream fix (commit 52b8f34468) authored by Rossen Stoyanchev that replaced AlternativeJdkIdGenerator with Jd...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-0201" }, "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client used AlternativeJdkIdGenerator for session IDs - which employs SecureRandom only for initial seeding, then uses predictable java.util.Random thereafter. The target version 4.3.9.RELEASE contains the upstream fix (commit 52b8f34468) authored by Rossen Stoyanchev that replaced AlternativeJdkIdGenerator with Jd..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T13:07:28.836714+00:00", "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download) is not present in Spring Framework 4.3.9.RELEASE. The upstream vendor (Pivotal) fixed this vulnerability in v4.2.2.RELEASE (October 2015) via commit 2bd1daa75e authored by rstoyanchev@pivotal.io. The target version 4.3.9.RELEASE was released by the upstream vendor with all RFD defenses already included: Content-Disposition attachment headers for non-whitelisted extensions, JSONP callback validation (pattern [0-9A-Za-z_\\.]*), proper path parameter handling in WebUtils.extractFullFilenameFromUrlPath, and /**/ prefix on JSONP responses. TuxCare onboarded version 4.3.9.RELEASE which already contained these fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-5211" }, "impact_statement": "CVE-2015-5211 (Reflected File Download) is not present in Spring Framework 4.3.9.RELEASE. The upstream vendor (Pivotal) fixed this vulnerability in v4.2.2.RELEASE (October 2015) via commit 2bd1daa75e authored by rstoyanchev@pivotal.io. The target version 4.3.9.RELEASE was released by the upstream vendor with all RFD defenses already included: Content-Disposition attachment headers for non-whitelisted extensions, JSONP callback validation (pattern [0-9A-Za-z_\\.]*), proper path parameter handling in WebUtils.extractFullFilenameFromUrlPath, and /**/ prefix on JSONP responses. TuxCare onboarded version 4.3.9.RELEASE which already contained these fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T13:17:11.201920+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 4.3.9.RELEASE. The vulnerability concerns URL pattern matching inconsistencies between Spring Security (authorization) and Spring MVC (controller mapping), particularly with space trimming in path segments. The upstream fix (commit a30ab30e4e from Rossen Stoyanchev at Pivotal) introduced a unified HandlerMappingIntrospector API and MatchableHandlerMapping interface, allowing Spring Security to use the exact same pattern matching logic as Spring MVC. This fix was already present in the upstream 4.3.9.RELEASE that TuxCare onboarded (commit 3b2a11ecf4), so the vulnerable pattern never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "CVE-2016-5007 is not present in Spring Framework 4.3.9.RELEASE. The vulnerability concerns URL pattern matching inconsistencies between Spring Security (authorization) and Spring MVC (controller mapping), particularly with space trimming in path segments. The upstream fix (commit a30ab30e4e from Rossen Stoyanchev at Pivotal) introduced a unified HandlerMappingIntrospector API and MatchableHandlerMapping interface, allowing Spring Security to use the exact same pattern matching logic as Spring MVC. This fix was already present in the upstream 4.3.9.RELEASE that TuxCare onboarded (commit 3b2a11ecf4), so the vulnerable pattern never existed in this TuxCare version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-11040" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-17T09:26:00.163449+00:00", "status_notes": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1199" }, "action_statement": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-1257 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.9.RELEASE-tuxcare.2.", "vulnerability": { "name": "CVE-2018-1257" }, "action_statement": "Vulnerability CVE-2018-1257 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.9.RELEASE-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-10T04:21:00.444930+00:00", "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because method resolution does not contain the regressed exclusion of dynamic proxy classes. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly to method resolution. spring-aop/src/main/java/org/springframework/aop/support/annotation/AnnotationMethodMatcher.java:51 checks the original method\u2019s annotation before resolving the target method, preserving annotations on the invoked interface method.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1258" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because method resolution does not contain the regressed exclusion of dynamic proxy classes. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly to method resolution. spring-aop/src/main/java/org/springframework/aop/support/annotation/AnnotationMethodMatcher.java:51 checks the original method\u2019s annotation before resolving the target method, preserving annotations on the invoked interface method." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-1271 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.9.RELEASE-tuxcare.2.", "vulnerability": { "name": "CVE-2018-1271" }, "action_statement": "Vulnerability CVE-2018-1271 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.9.RELEASE-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1272" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15756 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.9.RELEASE-tuxcare.2.", "vulnerability": { "name": "CVE-2018-15756" }, "action_statement": "Vulnerability CVE-2018-15756 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.9.RELEASE-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22096" }, "action_statement": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-10T04:24:00.586682+00:00", "status_notes": "Vulnerability CVE-2024-22233 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request URI comparison does not exist. Handler lookups call mappings directly in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:128, and the class ends with a simple request wrapper at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:175, without the CachedResult implementation or its vulnerable URI comparison.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2024-22233" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request URI comparison does not exist. Handler lookups call mappings directly in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:128, and the class ends with a simple request wrapper at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:175, without the CachedResult implementation or its vulnerable URI comparison." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41249 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.9.RELEASE-tuxcare.4.", "vulnerability": { "name": "CVE-2025-41249" }, "action_statement": "Vulnerability CVE-2025-41249 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 4.3.9.RELEASE-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2026-41848" }, "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-core." } ] }