{
  "@id": "urn:uuid:0206f1d4-3908-4944-87de-24a9799946d3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 52,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:40:04.386984+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:51:09.223913+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 does NOT affect Spring Framework 5.0.19.RELEASE. The vulnerability requires JDK < 1.6 to exploit an algorithmic complexity issue in java.util.regex.Pattern.compile. Spring 5.0.19 requires Java 8 (JDK 1.8) minimum and cannot run on JDK < 1.6. The underlying JDK vulnerability was fixed in JDK 1.6 (released 2006), which is 8 years older than the minimum JDK version Spring 5.0.19 supp...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 does NOT affect Spring Framework 5.0.19.RELEASE. The vulnerability requires JDK < 1.6 to exploit an algorithmic complexity issue in java.util.regex.Pattern.compile. Spring 5.0.19 requires Java 8 (JDK 1.8) minimum and cannot run on JDK < 1.6. The underlying JDK vulnerability was fixed in JDK 1.6 (released 2006), which is 8 years older than the minimum JDK version Spring 5.0.19 supp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:04.386984+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.0.19.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.0.19.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:51:00.166719+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.0.19.RELEASE is not affected by CVE-2011-2894. The vulnerability affected versions 3.0.0 through 3.0.5. The fix (acceptProxyClasses flag to prevent malicious proxy deserialization) was added by upstream maintainer Juergen Hoeller in commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb on July 21, 2011, and shipped with the upstream release 5.0.19.RELEASE. The vulnerable code patte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.0.19.RELEASE is not affected by CVE-2011-2894. The vulnerability affected versions 3.0.0 through 3.0.5. The fix (acceptProxyClasses flag to prevent malicious proxy deserialization) was added by upstream maintainer Juergen Hoeller in commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb on July 21, 2011, and shipped with the upstream release 5.0.19.RELEASE. The vulnerable code patte..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in target Spring Framework 5.0.19.RELEASE. The fix was already shipped in the upstream release before TuxCare onboarded it. The vulnerable code pattern (missing prefix validation in StringUtils.cleanPath) has been replaced with secure code that discards prefixes containing forward slashes (lines 660-665 of StringUtils.java), prevent...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in target Spring Framework 5.0.19.RELEASE. The fix was already shipped in the upstream release before TuxCare onboarded it. The vulnerable code pattern (missing prefix validation in StringUtils.cleanPath) has been replaced with secure code that discards prefixes containing forward slashes (lines 660-665 of StringUtils.java), prevent..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:20:00.402348+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client used AlternativeJdkIdGenerator for session IDs, which employed predictable Random-based generation after an initial SecureRandom seed. This allowed attackers to predict session IDs and send messages to other sessions. The vulnerability was fixed in upstream Spring Framework 4.1.5 (commit 52b8f34468, Jan 2015) by s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client used AlternativeJdkIdGenerator for session IDs, which employed predictable Random-based generation after an initial SecureRandom seed. This allowed attackers to predict session IDs and send messages to other sessions. The vulnerability was fixed in upstream Spring Framework 4.1.5 (commit 52b8f34468, Jan 2015) by s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:56.260651+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.0.19.RELEASE-tuxcare.3. The upstream fix commit 2bd1daa75e \"Protect against RFD exploits\" by Rossen Stoyanchev (Pivotal) was already included in the upstream 5.0.19.RELEASE before TuxCare onboarded it. All RFD protection mechanisms are present and active: extension whitelist, Content-Disposition header injection for unsafe extensions, JSONP callback validation, and JSONP prefix. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.0.19.RELEASE-tuxcare.3. The upstream fix commit 2bd1daa75e \"Protect against RFD exploits\" by Rossen Stoyanchev (Pivotal) was already included in the upstream 5.0.19.RELEASE before TuxCare onboarded it. All RFD protection mechanisms are present and active: extension whitelist, Content-Disposition header injection for unsafe extensions, JSONP callback validation, and JSONP prefix. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:59.012677+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2016-5007 fix was already present in the upstream Spring Framework 5.0.19.RELEASE. The vulnerability concerned inconsistent URL pattern matching between Spring Security (authorization layer) and Spring MVC (routing layer), allowing attackers to bypass security checks using specially crafted URLs with spaces, trailing slashes, or other format variations. The fix (commit a30ab30e4e9ae) introduced a MatchableHandlerMapping introspection API enabling Spring Security to use Spring MVC's exact pattern-matching logic. This fix was integrated into Spring Framework 4.3.1 (June 2016), well before the 5.0.19.RELEASE (October 2018) that TuxCare maintains. All defense components are present: MatchableHandlerMapping interface, HandlerMappingIntrospector class, and match() implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 fix was already present in the upstream Spring Framework 5.0.19.RELEASE. The vulnerability concerned inconsistent URL pattern matching between Spring Security (authorization layer) and Spring MVC (routing layer), allowing attackers to bypass security checks using specially crafted URLs with spaces, trailing slashes, or other format variations. The fix (commit a30ab30e4e9ae) introduced a MatchableHandlerMapping introspection API enabling Spring Security to use Spring MVC's exact pattern-matching logic. This fix was integrated into Spring Framework 4.3.1 (June 2016), well before the 5.0.19.RELEASE (October 2018) that TuxCare maintains. All defense components are present: MatchableHandlerMapping interface, HandlerMappingIntrospector class, and match() implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:00:11.067776+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. The target Spring Framework 5.0.19.RELEASE is not affected by CVE-2018-11040. The vulnerability affected versions 5.0.x prior to 5.0.7. The upstream fix (commit b80c13b722bb207ddf43f53a007ee3ddc1dd2e26 by Sebastien Deleuze, June 8, 2018) was included in the 5.0.19.RELEASE that TuxCare onboarded. The vulnerable code pattern (default JSONP parameters \"jsonp\" and \"callback\") is not present in the target; the jsonpParameterNames field is initialized to an empty LinkedHashSet, requiring explicit configuration to enable JSONP.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target Spring Framework 5.0.19.RELEASE is not affected by CVE-2018-11040. The vulnerability affected versions 5.0.x prior to 5.0.7. The upstream fix (commit b80c13b722bb207ddf43f53a007ee3ddc1dd2e26 by Sebastien Deleuze, June 8, 2018) was included in the 5.0.19.RELEASE that TuxCare onboarded. The vulnerable code pattern (default JSONP parameters \"jsonp\" and \"callback\") is not present in the target; the jsonpParameterNames field is initialized to an empty LinkedHashSet, requiring explicit configuration to enable JSONP.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:14:00.204394+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 (SPR-16616) addresses path parameter bypass via special encodings and separator variations that could allow access to files outside allowed resource locations. The upstream Spring Framework fix (commits 0e28bee0f1, 91b803a231, f59ea610df, 13356a7ee2) was already included in version 5.0.19.RELEASE when TuxCare onboarded it. The target at SHA 6e72f98350 (5.0.19.RELEASE-tuxcare.3) co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 (SPR-16616) addresses path parameter bypass via special encodings and separator variations that could allow access to files outside allowed resource locations. The upstream Spring Framework fix (commits 0e28bee0f1, 91b803a231, f59ea610df, 13356a7ee2) was already included in version 5.0.19.RELEASE when TuxCare onboarded it. The target at SHA 6e72f98350 (5.0.19.RELEASE-tuxcare.3) co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6. The target version 5.0.19.RELEASE already contains the upstream fix that allows the selector header feature to be disabled, preventing the ReDoS vulnerability. The fix was present in the upstream release before TuxCare onboarded it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6. The target version 5.0.19.RELEASE already contains the upstream fix that allows the selector header feature to be disabled, preventing the ReDoS vulnerability. The fix was present in the upstream release before TuxCare onboarded it."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-1258 is not present in Spring Framework 5.0.19.RELEASE. The vulnerability is an authorization bypass in method security caused by incorrect method resolution for JDK dynamic proxies. The upstream vendor (Spring/Pivotal) fixed this issue in commits 8b051ab06ef and f2e77c292d, which were included in the 5.0.19.RELEASE that TuxCare onboarded. The fixes are present in all affected files: AopUtils.java correctly processes proxy classes, AnnotationMethodMatcher.java includes the proxy class check, and CacheAspectSupport.java properly resolves target methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is not present in Spring Framework 5.0.19.RELEASE. The vulnerability is an authorization bypass in method security caused by incorrect method resolution for JDK dynamic proxies. The upstream vendor (Spring/Pivotal) fixed this issue in commits 8b051ab06ef and f2e77c292d, which were included in the 5.0.19.RELEASE that TuxCare onboarded. The fixes are present in all affected files: AopUtils.java correctly processes proxy classes, AnnotationMethodMatcher.java includes the proxy class check, and CacheAspectSupport.java properly resolves target methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:00.117091+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 (Windows directory traversal via backslash path separators) is NOT present in Spring Framework 5.0.19.RELEASE. The fix was already shipped in the upstream release (version 5.0.19 > 5.0.5, the first fixed version). The target contains the complete mitigation: backslash-to-forward-slash normalization in processPath() and explicit checks for both \"../\" and \"..\\\\\" patterns in isInvali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 (Windows directory traversal via backslash path separators) is NOT present in Spring Framework 5.0.19.RELEASE. The fix was already shipped in the upstream release (version 5.0.19 > 5.0.5, the first fixed version). The target contains the complete mitigation: backslash-to-forward-slash normalization in processPath() and explicit checks for both \"../\" and \"..\\\\\" patterns in isInvali..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-1272 concerns predictable multipart boundary generation in Spring Framework due to using weak Random() instead of SecureRandom. The target repository (Spring Framework 5.0.19.RELEASE at SHA 6effade787) is NOT AFFECTED because the upstream fix commit ab2410c754 (authored by rstoyanchev@pivotal.io on 2018-03-23) was already present in the upstream v5.0.19.RELEASE tag before TuxCare onboarded this version. The target code uses SecureRandom for boundary generation via MimeTypeUtils.initRandom() at line 330, preventing the vulnerability. All multipart boundary generation in production code (FormHttpMessageConverter, MultipartHttpMessageWriter, ResourceRegionHttpMessageConverter) delegates to MimeTypeUtils.generateMultipartBoundary(), ensuring centralized protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 concerns predictable multipart boundary generation in Spring Framework due to using weak Random() instead of SecureRandom. The target repository (Spring Framework 5.0.19.RELEASE at SHA 6effade787) is NOT AFFECTED because the upstream fix commit ab2410c754 (authored by rstoyanchev@pivotal.io on 2018-03-23) was already present in the upstream v5.0.19.RELEASE tag before TuxCare onboarded this version. The target code uses SecureRandom for boundary generation via MimeTypeUtils.initRandom() at line 330, preventing the vulnerability. All multipart boundary generation in production code (FormHttpMessageConverter, MultipartHttpMessageWriter, ResourceRegionHttpMessageConverter) delegates to MimeTypeUtils.generateMultipartBoundary(), ensuring centralized protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:44:14.640121+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.0.19.RELEASE. The upstream vendor (Pivotal) fixed this DoS vulnerability in commit c8e320019f (Oct 2018) by adding two defenses: (1) MAX_RANGES=100 limit to reject requests with >100 ranges, and (2) sum-of-ranges validation to prevent overlapping/wide ranges from exceeding resource length. Both defenses are present and active in the target at HttpRange.java lines 48,135-137 (MAX_RANGES check) and lines 184-194 (sum validation). The fix shipped in upstream release 5.0.19.RELEASE before TuxCare onboarding (commit d5717cf235c7). No TuxCare backport was needed\u2014the target inherited the fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.0.19.RELEASE. The upstream vendor (Pivotal) fixed this DoS vulnerability in commit c8e320019f (Oct 2018) by adding two defenses: (1) MAX_RANGES=100 limit to reject requests with >100 ranges, and (2) sum-of-ranges validation to prevent overlapping/wide ranges from exceeding resource length. Both defenses are present and active in the target at HttpRange.java lines 48,135-137 (MAX_RANGES check) and lines 184-194 (sum validation). The fix shipped in upstream release 5.0.19.RELEASE before TuxCare onboarding (commit d5717cf235c7). No TuxCare backport was needed\u2014the target inherited the fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T19:49:00.206678+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T17:51:49.982224+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.0.19.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.0.19.RELEASE-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.19.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T17:51:49.982224+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.0.19.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.0.19.RELEASE-tuxcare.4."
    }
  ]
}