{
  "@id": "urn:uuid:4dcac4e5-9123-4cbe-8cef-453042a81eac",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 39,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:38:27.865569+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T12:44:06.454395+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.0.5.RELEASE is not affected by CVE-2009-1190. This CVE targets an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6, exploitable via serialized objects containing pathological regex patterns. While Spring 5.0.5 retains the deserialization entry points (HttpInvokerServiceExporter) and Pattern.compile usage (JdkRegexpMethodPointc...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.0.5.RELEASE is not affected by CVE-2009-1190. This CVE targets an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6, exploitable via serialized objects containing pathological regex patterns. While Spring 5.0.5 retains the deserialization entry points (HttpInvokerServiceExporter) and Pattern.compile usage (JdkRegexpMethodPointc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T17:38:27.865569+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.0.5.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.0.5.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T09:47:00.137511+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 due to unrestricted deserialization of proxy classes. The target version 5.0.5.RELEASE is NOT AFFECTED because the upstream vendor fix (commit 7d8aa05c407 by Juergen Hoeller on 2011-07-21) was already present in the upstream release before TuxCare onboarded this version. The fix adds an `acceptProxyClasses` flag to ConfigurableObjectInputStream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 due to unrestricted deserialization of proxy classes. The target version 5.0.5.RELEASE is NOT AFFECTED because the upstream vendor fix (commit 7d8aa05c407 by Juergen Hoeller on 2011-07-21) was already present in the upstream release before TuxCare onboarded this version. The fix adds an `acceptProxyClasses` flag to ConfigurableObjectInputStream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target is version 5.0.5.RELEASE, which already contains the upstream fix from May 2014 (commit 8ee4651038). The fix validates path prefixes during cleanPath() processing to prevent directory traversal via crafted URLs with malformed prefixes. The vulnerable pattern is not present - the fix was shipped in the upstr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target is version 5.0.5.RELEASE, which already contains the upstream fix from May 2014 (commit 8ee4651038). The fix validates path prefixes during cleanPath() processing to prevent directory traversal via crafted URLs with malformed prefixes. The vulnerable pattern is not present - the fix was shipped in the upstr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:13:41.066350+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in upstream Spring 4.1.5 (January 2015) by switching from AlternativeJdkIdGenerator to JdkIdGenerator. The target version 5.0.5.RELEASE already contains this upstream fix - it uses JdkIdGenerator with UUID.randomUUID() for cryptographically se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in upstream Spring 4.1.5 (January 2015) by switching from AlternativeJdkIdGenerator to JdkIdGenerator. The target version 5.0.5.RELEASE already contains this upstream fix - it uses JdkIdGenerator with UUID.randomUUID() for cryptographically se..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:06:45.482707+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. Spring Framework 5.0.5.RELEASE is not affected by CVE-2015-5211 (Reflected File Download vulnerability). The upstream vendor (Pivotal/Spring) fixed this vulnerability in October 2015 via commit 2bd1daa (\"Protect against RFD exploits\"), which added Content-Disposition header protections and file extension whitelisting. This fix was already present in the upstream 5.0.5.RELEASE (March 2018) before TuxCare onboarded it. The target contains the complete defense: addContentDispositionHeader() method validates URL file extensions against a whitelist and adds Content-Disposition headers for unsafe extensions, preventing browsers from executing downloaded content as malicious file types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.0.5.RELEASE is not affected by CVE-2015-5211 (Reflected File Download vulnerability). The upstream vendor (Pivotal/Spring) fixed this vulnerability in October 2015 via commit 2bd1daa (\"Protect against RFD exploits\"), which added Content-Disposition header protections and file extension whitelisting. This fix was already present in the upstream 5.0.5.RELEASE (March 2018) before TuxCare onboarded it. The target contains the complete defense: addContentDispositionHeader() method validates URL file extensions against a whitelist and adds Content-Disposition headers for unsafe extensions, preventing browsers from executing downloaded content as malicious file types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:11.201920+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. Spring Framework 5.0.5.RELEASE is NOT affected by CVE-2016-5007. The vulnerability concerns differences in URL pattern matching between Spring Security and Spring MVC that could lead to authorization bypass. The fix (commit a30ab30e4e, April 2016) introduced the HandlerMappingIntrospector API, MatchableHandlerMapping interface, and RequestMatchResult class to allow Spring Security to use Spring MVC's exact pattern matching logic. This fix was already present in the upstream Spring Framework 5.0.5.RELEASE (released April 2018) before TuxCare onboarded it. The target contains all defensive components: HandlerMappingIntrospector, MatchableHandlerMapping implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping, and functional match() methods that expose Spring MVC's pattern matching to authorization layers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.0.5.RELEASE is NOT affected by CVE-2016-5007. The vulnerability concerns differences in URL pattern matching between Spring Security and Spring MVC that could lead to authorization bypass. The fix (commit a30ab30e4e, April 2016) introduced the HandlerMappingIntrospector API, MatchableHandlerMapping interface, and RequestMatchResult class to allow Spring Security to use Spring MVC's exact pattern matching logic. This fix was already present in the upstream Spring Framework 5.0.5.RELEASE (released April 2018) before TuxCare onboarded it. The target contains all defensive components: HandlerMappingIntrospector, MatchableHandlerMapping implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping, and functional match() methods that expose Spring MVC's pattern matching to authorization layers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T01:13:00.113752+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Target Spring Framework 5.0.5.RELEASE is not affected by CVE-2018-1199. The vulnerability fix (SPR-16616) was included in upstream Spring Framework 5.0.5.RELEASE (released April 2018) BEFORE TuxCare onboarded the project (July 2026). The fix adds path normalization (removes duplicate slashes, converts backslashes) and encoded path traversal detection (isInvalidEncodedPath) to ResourceHttpReques...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Target Spring Framework 5.0.5.RELEASE is not affected by CVE-2018-1199. The vulnerability fix (SPR-16616) was included in upstream Spring Framework 5.0.5.RELEASE (released April 2018) BEFORE TuxCare onboarded the project (July 2026). The fix adds path normalization (removes duplicate slashes, converts backslashes) and encoded path traversal detection (isInvalidEncodedPath) to ResourceHttpReques..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 is fixed in version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1257"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 is fixed in version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T11:00:05.020596+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 The target (Spring Framework 5.0.5.RELEASE-tuxcare.7) is NOT AFFECTED by CVE-2018-1271. The vulnerability affects Spring Framework versions 5.0 PRIOR to 5.0.5, but the target is based on v5.0.5.RELEASE which already contains the complete upstream fix for this directory traversal vulnerability. All fix commits for SPR-16616 (the issue ID for CVE-2018-1271) were included in the upstream v5.0.5.RE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Framework 5.0.5.RELEASE-tuxcare.7) is NOT AFFECTED by CVE-2018-1271. The vulnerability affects Spring Framework versions 5.0 PRIOR to 5.0.5, but the target is based on v5.0.5.RELEASE which already contains the complete upstream fix for this directory traversal vulnerability. All fix commits for SPR-16616 (the issue ID for CVE-2018-1271) were included in the upstream v5.0.5.RE..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core. Target version 5.0.5.RELEASE is not affected by CVE-2018-1272. The vulnerability concerns predictable multipart boundary generation using java.util.Random, enabling attackers to inject additional multipart sections into proxied requests. The fix (replacing Random with SecureRandom in MimeTypeUtils.java) was shipped in the upstream Spring Framework 5.0.5.RELEASE before TuxCare onboarded it. The CVE explicitly states \"versions 5.0 prior to 5.0.5\" are affected, confirming 5.0.5 as the first fixed version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Target version 5.0.5.RELEASE is not affected by CVE-2018-1272. The vulnerability concerns predictable multipart boundary generation using java.util.Random, enabling attackers to inject additional multipart sections into proxied requests. The fix (replacing Random with SecureRandom in MimeTypeUtils.java) was shipped in the upstream Spring Framework 5.0.5.RELEASE before TuxCare onboarded it. The CVE explicitly states \"versions 5.0 prior to 5.0.5\" are affected, confirming 5.0.5 as the first fixed version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 is fixed in version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core, and is fixed in 5.0.5.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core, and is fixed in 5.0.5.RELEASE-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T03:39:22.988337+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core, and is fixed in 5.0.5.RELEASE-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core, and is fixed in 5.0.5.RELEASE-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.5.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core, and is fixed in 5.0.5.RELEASE-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.0.5.RELEASE-tuxcare.4 of org.springframework:spring-core, and is fixed in 5.0.5.RELEASE-tuxcare.6."
    }
  ]
}