{
  "@id": "urn:uuid:438123b3-969f-4cb1-85ee-f9fdd8f6e330",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 40,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:23:42.223331+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:38:02.053506+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 exploits an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6. Spring Framework 5.0.0.RELEASE requires JDK 8 to run (sourceCompatibility = 1.8, per build.gradle lines 114-115, and README documentation). JDK 1.6 (released 2006) fixed the Pattern.compile algorithmic complexity issue, and JDK 8 (2014) is well beyond that threshold. While Sp...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 exploits an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6. Spring Framework 5.0.0.RELEASE requires JDK 8 to run (sourceCompatibility = 1.8, per build.gradle lines 114-115, and README documentation). JDK 1.6 (released 2006) fixed the Pattern.compile algorithmic complexity issue, and JDK 8 (2014) is well beyond that threshold. While Sp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:37:00.050625+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.0.0.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.0.0.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:45:17.985105+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 (insecure deserialization of proxy classes) is NOT present in Spring Framework 5.0.0.RELEASE. The vulnerability affects Spring Framework 3.0.0-3.0.5. The fix was introduced by upstream Spring in version 3.0.6.RELEASE (commit 070a723ef2, July 2011) and is present in the 5.0.0.RELEASE that TuxCare onboarded in September 2026. The defense mechanism (acceptProxyClasses flag with valid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 (insecure deserialization of proxy classes) is NOT present in Spring Framework 5.0.0.RELEASE. The vulnerability affects Spring Framework 3.0.0-3.0.5. The fix was introduced by upstream Spring in version 3.0.6.RELEASE (commit 070a723ef2, July 2011) and is present in the 5.0.0.RELEASE that TuxCare onboarded in September 2026. The defense mechanism (acceptProxyClasses flag with valid..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.0.0.RELEASE. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already included in the 5.0.0.RELEASE when TuxCare onboarded it. The fix adds validation to StringUtils.cleanPath() that discards malformed path prefixes containing both \":\" and \"/\" characters, preventing crafted URLs like \"/a/:...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.0.0.RELEASE. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already included in the 5.0.0.RELEASE when TuxCare onboarded it. The fix adds validation to StringUtils.cleanPath() that discards malformed path prefixes containing both \":\" and \"/\" characters, preventing crafted URLs like \"/a/:..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:15:37.688994+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 is not present in Spring Framework 5.0.0.RELEASE. The vulnerability concerned predictable session ID generation in the SockJS client, which used AlternativeJdkIdGenerator (predictable java.util.Random seeded once with SecureRandom). The fix replaced it with JdkIdGenerator using UUID.randomUUID() for cryptographically secure session IDs. This fix was committed by upstream developer...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 is not present in Spring Framework 5.0.0.RELEASE. The vulnerability concerned predictable session ID generation in the SockJS client, which used AlternativeJdkIdGenerator (predictable java.util.Random seeded once with SecureRandom). The fix replaced it with JdkIdGenerator using UUID.randomUUID() for cryptographically secure session IDs. This fix was committed by upstream developer..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download vulnerability) is NOT present in Spring Framework 5.0.0.RELEASE. The upstream fix commit 2bd1daa75e by Rossen Stoyanchev was already included in the 5.0.0.RELEASE before TuxCare onboarded it. All RFD defenses are present: extension whitelist (WHITELISTED_EXTENSIONS), Content-Disposition header logic (addContentDispositionHeader), extension validation (safeExtension), and JSONP protection (/**/ prefix). The vulnerable pattern does not exist because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download vulnerability) is NOT present in Spring Framework 5.0.0.RELEASE. The upstream fix commit 2bd1daa75e by Rossen Stoyanchev was already included in the 5.0.0.RELEASE before TuxCare onboarded it. All RFD defenses are present: extension whitelist (WHITELISTED_EXTENSIONS), Content-Disposition header logic (addContentDispositionHeader), extension validation (safeExtension), and JSONP protection (/**/ prefix). The vulnerable pattern does not exist because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:15:34.961054+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 5.0.0.RELEASE-tuxcare.1. The vulnerability concerns path matching discrepancies between Spring Security authorization patterns and Spring MVC controller routing that could lead to authorization bypass. The fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5) introduces HandlerMappingIntrospector, MatchableHandlerMapping interface, and RequestMatchResult classes that allow external components to use the SAME path matching logic as Spring MVC. This upstream fix was already included in the 5.0.0.RELEASE before TuxCare onboarding (first TuxCare commit: 80d03e1030). All fix components are present and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 5.0.0.RELEASE-tuxcare.1. The vulnerability concerns path matching discrepancies between Spring Security authorization patterns and Spring MVC controller routing that could lead to authorization bypass. The fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5) introduces HandlerMappingIntrospector, MatchableHandlerMapping interface, and RequestMatchResult classes that allow external components to use the SAME path matching logic as Spring MVC. This upstream fix was already included in the 5.0.0.RELEASE before TuxCare onboarding (first TuxCare commit: 80d03e1030). All fix components are present and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T18:16:30.070148+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.0.0.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "action_statement": "Vulnerability CVE-2018-11040 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.0.0.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-17T09:43:00.166710+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-04T09:57:00.370588+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:00.444930+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it already resolves target methods without the proxy-class exclusion responsible for the vulnerability. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:194 passes the target class directly to method resolution and resolves bridge methods. spring-aop/src/main/java/org/springframework/aop/support/annotation/AnnotationMethodMatcher.java:70 checks annotations on both the original method and the resolved specific method.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it already resolves target methods without the proxy-class exclusion responsible for the vulnerability. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:194 passes the target class directly to method resolution and resolves bridge methods. spring-aop/src/main/java/org/springframework/aop/support/annotation/AnnotationMethodMatcher.java:70 checks annotations on both the original method and the resolved specific method."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-04T09:57:00.370588+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1271"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-04T09:57:00.370588+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-04T09:57:00.370588+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-04T09:52:03.463289+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:23:42.223331+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI comparison code is absent. spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:210 shows that the class contains no CachedResult, cache filter, or URI regex comparison.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI comparison code is absent. spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:210 shows that the class contains no CachedResult, cache filter, or URI regex comparison."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T18:16:30.070148+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.0.0.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.0.0.RELEASE-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.0.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-04T09:57:00.370588+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}