{ "@id": "urn:uuid:f2d8659b-ec0a-4916-9813-bd4e0315cf76", "role": "Document Creator", "author": "https://tuxcare.com", "version": 4, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:23:42.223331+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 affects Spring Framework 1.1.0-2.5.6 and 3.0.0.M1-M2 via ReDoS in Pattern.compile when processing untrusted regex patterns. Target version 5.1.1.RELEASE (2018) is classified as NOT AFFECTED because Spring Framework, as a library, does not have production entry points that route external attacker-controllable input through PatternEditor. While PatternEditor.setAsText() still calls ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 CVE-2009-1190 affects Spring Framework 1.1.0-2.5.6 and 3.0.0.M1-M2 via ReDoS in Pattern.compile when processing untrusted regex patterns. Target version 5.1.1.RELEASE (2018) is classified as NOT AFFECTED because Spring Framework, as a library, does not have production entry points that route external attacker-controllable input through PatternEditor. While PatternEditor.setAsText() still calls ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2730" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of Java proxy objects. The upstream vendor (Spring Framework) introduced a configurable protection mechanism in July 2011 (commit 7d8aa05c) that allows applications to reject proxy deserialization via `setAcceptProxyClasses(false)`. This fix shipped in upstream Spring Framework 5.1.1.RELEASE before TuxCare onboarded t...", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of Java proxy objects. The upstream vendor (Spring Framework) introduced a configurable protection mechanism in July 2011 (commit 7d8aa05c) that allows applications to reject proxy deserialization via `setAcceptProxyClasses(false)`. This fix shipped in upstream Spring Framework 5.1.1.RELEASE before TuxCare onboarded t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.1.1.RELEASE. The upstream fix (commit 8ee4651038, May 2014) was already included in this release. The fix adds validation at StringUtils.java:649-651 that resets the URI prefix to empty when it contains a forward slash, preventing path confusion attacks via crafted URLs like \"/a/:b/../../sensitive/file\".", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3578" }, "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.1.1.RELEASE. The upstream fix (commit 8ee4651038, May 2014) was already included in this release. The fix adds validation at StringUtils.java:649-651 that resets the URI prefix to empty when it contains a forward slash, preventing path confusion attacks via crafted URLs like \"/a/:b/../../sensitive/file\"." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client used AlternativeJdkIdGenerator (predictable Random after initial seed) for session IDs. The target version 5.1.1.RELEASE already uses JdkIdGenerator (cryptographically secure UUID.randomUUID()) as shown in SockJsUrlInfo.java line 39. This fix was introduced in upstream Spring Framework 4.1.5 (commit 52b8f34468, au...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-0201" }, "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client used AlternativeJdkIdGenerator (predictable Random after initial seed) for session IDs. The target version 5.1.1.RELEASE already uses JdkIdGenerator (cryptographically secure UUID.randomUUID()) as shown in SockJsUrlInfo.java line 39. This fix was introduced in upstream Spring Framework 4.1.5 (commit 52b8f34468, au..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T18:55:56.150579+00:00", "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download) was fixed upstream in Spring Framework 3.2.15, 4.1.8 and 4.2.2 (October 2015). 5.1.1.RELEASE contains the fix: AbstractMessageConverterMethodProcessor has the safe-extension whitelist and adds a Content-Disposition header in addContentDispositionHeader() before writing the response. The vulnerable code is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-5211" }, "impact_statement": "CVE-2015-5211 (Reflected File Download) was fixed upstream in Spring Framework 3.2.15, 4.1.8 and 4.2.2 (October 2015). 5.1.1.RELEASE contains the fix: AbstractMessageConverterMethodProcessor has the safe-extension whitelist and adds a Content-Disposition header in addContentDispositionHeader() before writing the response. The vulnerable code is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8crv-49fr-2h6j (affected up to 4.3.1), NVD (affected up to 4.2.9), CVE record (affected up to 4.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8crv-49fr-2h6j (affected up to 4.3.1), NVD (affected up to 4.2.9), CVE record (affected up to 4.3)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2018-11040 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-11040" }, "action_statement": "Vulnerability CVE-2018-11040 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.1.RELEASE is not affected by CVE-2018-1199. The vulnerability was fixed by upstream Spring developers in March 2018 (commits 0e28bee0f1, f046a066ec, and related SPR-16616 series), and these fixes were already included in the 5.1.1.RELEASE (October 2018) that TuxCare onboarded. The target code contains all required defenses: path normalization in processPath(), duplicate sla...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 Spring Framework 5.1.1.RELEASE is not affected by CVE-2018-1199. The vulnerability was fixed by upstream Spring developers in March 2018 (commits 0e28bee0f1, f046a066ec, and related SPR-16616 series), and these fixes were already included in the 5.1.1.RELEASE (October 2018) that TuxCare onboarded. The target code contains all required defenses: path normalization in processPath(), duplicate sla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, allowing ReDoS attacks via malicious selector expressions in STOMP subscription messages. The target version 5.1.1.RELEASE is NOT AFFECTED because the fix (commit ff2228fdaf, April 2018) was already included in the upstream Spring 5.1.0.RELEASE (September 2018) before TuxCare onboarded it. The fix ad...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1257" }, "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, allowing ReDoS attacks via malicious selector expressions in STOMP subscription messages. The target version 5.1.1.RELEASE is NOT AFFECTED because the fix (commit ff2228fdaf, April 2018) was already included in the upstream Spring 5.1.0.RELEASE (September 2018) before TuxCare onboarded it. The fix ad..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-cxrj-66c5-9fmh (affected up to 5.0.6.RELEASE), NVD (affected up to 5.0.5), CVE record (affected up to 5.0.5), Snyk (affected up to 5.0.6.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1258" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-cxrj-66c5-9fmh (affected up to 5.0.6.RELEASE), NVD (affected up to 5.0.5), CVE record (affected up to 5.0.5), Snyk (affected up to 5.0.6.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.1.1.RELEASE. The upstream fix (SPR-16616) was already included in the 5.1.1.RELEASE version that TuxCare onboarded. The fix adds comprehensive protections: (1) processPath() normalization that converts backslashes to forward slashes and removes duplicate slashes; (2) isInvalidEncodedPath() validation that decod...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1271" }, "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.1.1.RELEASE. The upstream fix (SPR-16616) was already included in the 5.1.1.RELEASE version that TuxCare onboarded. The fix adds comprehensive protections: (1) processPath() normalization that converts backslashes to forward slashes and removes duplicate slashes; (2) isInvalidEncodedPath() validation that decod..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2018-1272 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1272" }, "action_statement": "Vulnerability CVE-2018-1272 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 5.1.1.RELEASE, which is this version. Advisories: GitHub GHSA-ffvq-7w96-97p7 (fixed in 5.1.1.RELEASE), NVD (affected up to 5.0.10), CVE record (last affected 5.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15756" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 5.1.1.RELEASE, which is this version. Advisories: GitHub GHSA-ffvq-7w96-97p7 (fixed in 5.1.1.RELEASE), NVD (affected up to 5.0.10), CVE record (last affected 5.1)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2021-22096 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22096" }, "action_statement": "Vulnerability CVE-2021-22096 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-10T04:23:42.223331+00:00", "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI regular expression comparison does not exist. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:123, getMatchableHandlerMapping wraps the request and directly iterates handler mappings without consulting a cached URI.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-22233" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI regular expression comparison does not exist. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:123, getMatchableHandlerMapping wraps the request and directly iterates handler mappings without consulting a cached URI." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:36:25.976713+00:00", "status_notes": "Vulnerability CVE-2025-41249 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2025-41249" }, "action_statement": "Vulnerability CVE-2025-41249 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.1.1.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-09T16:37:29.696464+00:00", "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2026-41848" } } ] }