{
  "@id": "urn:uuid:86725591-1880-450b-9646-ec8421fc2f65",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:25:00.091559+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:32:17.496522+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2009-1190. While the vulnerable code pattern exists (JdkRegexpMethodPointcut has non-transient Pattern[] fields that could trigger expensive regex compilation during deserialization), the underlying vulnerability requires JDK < 1.6. Spring 5.1.18 requires JDK 8+ (confirmed in docs and build config), which has the Pattern.compile algorithmic...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2009-1190. While the vulnerable code pattern exists (JdkRegexpMethodPointcut has non-transient Pattern[] fields that could trigger expensive regex compilation during deserialization), the underlying vulnerability requires JDK < 1.6. Spring 5.1.18 requires JDK 8+ (confirmed in docs and build config), which has the Pattern.compile algorithmic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:12.209513+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.18.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.18.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:51:00.166719+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes) was fixed by upstream Spring Framework in commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb on July 21, 2011, which shipped in Spring Framework 3.0.6. This fix was already present in the upstream 5.1.18.RELEASE before TuxCare onboarded it. The fix adds acceptProxyClasses c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes) was fixed by upstream Spring Framework in commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb on July 21, 2011, which shipped in Spring Framework 3.0.6. This fix was already present in the upstream 5.1.18.RELEASE before TuxCare onboarded it. The fix adds acceptProxyClasses c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:32:17.496522+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.1.18.RELEASE-tuxcare.2. The vulnerability was a directory traversal flaw in StringUtils.cleanPath() that incorrectly handled paths containing colons after path separators (e.g., \"/a/:b/../../\"). The fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66 from 2014-05-15) was authored by the upstream Spring team (rstoyanchev@gopivotal.com) and was ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.1.18.RELEASE-tuxcare.2. The vulnerability was a directory traversal flaw in StringUtils.cleanPath() that incorrectly handled paths containing colons after path separators (e.g., \"/a/:b/../../\"). The fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66 from 2014-05-15) was authored by the upstream Spring team (rstoyanchev@gopivotal.com) and was ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:20:43.319935+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target is not affected by CVE-2015-0201. The vulnerable code pattern (predictable session ID generation using AlternativeJdkIdGenerator with java.util.Random) was removed by upstream Spring Framework in version 4.1.5 and replaced with cryptographically secure generation using JdkIdGenerator (which calls UUID.randomUUID() with SecureRandom). This fix was already present in Spring Framework 5...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 The target is not affected by CVE-2015-0201. The vulnerable code pattern (predictable session ID generation using AlternativeJdkIdGenerator with java.util.Random) was removed by upstream Spring Framework in version 4.1.5 and replaced with cryptographically secure generation using JdkIdGenerator (which calls UUID.randomUUID() with SecureRandom). This fix was already present in Spring Framework 5..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. Target version 5.1.18.RELEASE is not affected by CVE-2015-5211 (Reflected File Download). The vulnerability required extracting file extensions from URL paths without sanitizing query/path/fragment parameters. In Spring 5.x, file extension extraction uses UriUtils.extractFileExtension() which properly strips '?', '#', and ';' parameters before extraction - the same defense added to older versions in 2015. This protection was implemented by upstream Spring in July 2016 (commit adc595b5) and shipped in the v5.1.18.RELEASE that TuxCare onboarded. Additionally, JSONP support (the other attack vector mentioned in the CVE) was removed in Spring 5.x, eliminating that risk entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Target version 5.1.18.RELEASE is not affected by CVE-2015-5211 (Reflected File Download). The vulnerability required extracting file extensions from URL paths without sanitizing query/path/fragment parameters. In Spring 5.x, file extension extraction uses UriUtils.extractFileExtension() which properly strips '?', '#', and ';' parameters before extraction - the same defense added to older versions in 2015. This protection was implemented by upstream Spring in July 2016 (commit adc595b5) and shipped in the v5.1.18.RELEASE that TuxCare onboarded. Additionally, JSONP support (the other attack vector mentioned in the CVE) was removed in Spring 5.x, eliminating that risk entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:18:44.496921+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.1.18.RELEASE is not affected by CVE-2016-5007. The vulnerability concerned URL pattern matching discrepancies between Spring Security (authorization) and Spring Framework (controller routing) that could lead to authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev, introducing HandlerMappingIntrospector API in Spring 4.3.1) was already present in the upstream 5.1.18.RELEASE when TuxCare onboarded it. All fix components are fully implemented in the target at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/. The vulnerable pattern (absence of standardized pattern-matching introspection API) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.1.18.RELEASE is not affected by CVE-2016-5007. The vulnerability concerned URL pattern matching discrepancies between Spring Security (authorization) and Spring Framework (controller routing) that could lead to authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev, introducing HandlerMappingIntrospector API in Spring 4.3.1) was already present in the upstream 5.1.18.RELEASE when TuxCare onboarded it. All fix components are fully implemented in the target at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/. The vulnerable pattern (absence of standardized pattern-matching introspection API) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:13.058306+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.1.18.RELEASE is not affected by CVE-2018-11040. The vulnerability concerned automatic JSONP (JSON with Padding) support through MappingJackson2JsonView and AbstractJsonpResponseBodyAdvice, which allowed cross-domain requests via \"jsonp\" and \"callback\" query parameters. All JSONP functionality was completely removed by the upstream vendor (Pivotal/VMware) in commit ac37b678a3 (\"Remove JSONP support\") on June 7, 2018, before Spring Framework 5.1.0 was released. The target version 5.1.18.RELEASE, onboarded by TuxCare on commit 60c097cc1b, inherited this upstream fix. Verification confirms: (1) MappingJackson2JsonView has no jsonpParameterNames field or JSONP-related code, (2) AbstractJsonpResponseBodyAdvice.java does not exist, (3) no code path processes JSONP query parameters. The vulnerable code pattern is absent (Type A1).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.1.18.RELEASE is not affected by CVE-2018-11040. The vulnerability concerned automatic JSONP (JSON with Padding) support through MappingJackson2JsonView and AbstractJsonpResponseBodyAdvice, which allowed cross-domain requests via \"jsonp\" and \"callback\" query parameters. All JSONP functionality was completely removed by the upstream vendor (Pivotal/VMware) in commit ac37b678a3 (\"Remove JSONP support\") on June 7, 2018, before Spring Framework 5.1.0 was released. The target version 5.1.18.RELEASE, onboarded by TuxCare on commit 60c097cc1b, inherited this upstream fix. Verification confirms: (1) MappingJackson2JsonView has no jsonpParameterNames field or JSONP-related code, (2) AbstractJsonpResponseBodyAdvice.java does not exist, (3) no code path processes JSONP query parameters. The vulnerable code pattern is absent (Type A1).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:15:16.880365+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 fix is present in target version 5.1.18.RELEASE. The vulnerability allowed attackers to bypass security constraints on static resources using path parameters with special encodings (duplicate slashes, backslashes, URL-encoded traversal sequences). The fix adds path normalization (processPath method) that converts backslashes to forward slashes, removes duplicate slashes, and valid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 fix is present in target version 5.1.18.RELEASE. The vulnerability allowed attackers to bypass security constraints on static resources using path parameters with special encodings (duplicate slashes, backslashes, URL-encoded traversal sequences). The fix adds path normalization (processPath method) that converts backslashes to forward slashes, removes duplicate slashes, and valid..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:32:17.496522+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.18.RELEASE is NOT vulnerable to CVE-2018-1257 (ReDoS in STOMP WebSocket selector header). The fix was committed upstream in April 2018 (ff2228fdaf) before any 5.1.x version was released. The vulnerable code pattern never existed in the 5.1.x line. The fix allows administrators to disable selector header processing by setting the selector header name to null, preventing mali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.18.RELEASE is NOT vulnerable to CVE-2018-1257 (ReDoS in STOMP WebSocket selector header). The fix was committed upstream in April 2018 (ff2228fdaf) before any 5.1.x version was released. The vulnerable code pattern never existed in the 5.1.x line. The fix allows administrators to disable selector header processing by setting the selector header name to null, preventing mali..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.1.18.RELEASE-tuxcare.2 is NOT AFFECTED by CVE-2018-1258. The vulnerability (authorization bypass in method security due to improper proxy method resolution) was fixed in upstream commits aa11721ff0 and eaff2c28a7 by Juergen Hoeller in April 2018. These fixes were already present in the upstream Spring Framework 5.1.18.RELEASE when TuxCare onboarded it. All three key defenses are present in the current code: AopUtils.getMostSpecificMethod correctly processes proxy classes, AnnotationMethodMatcher has the proxy early-return check, and CacheAspectSupport properly resolves target methods for proxy classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.1.18.RELEASE-tuxcare.2 is NOT AFFECTED by CVE-2018-1258. The vulnerability (authorization bypass in method security due to improper proxy method resolution) was fixed in upstream commits aa11721ff0 and eaff2c28a7 by Juergen Hoeller in April 2018. These fixes were already present in the upstream Spring Framework 5.1.18.RELEASE when TuxCare onboarded it. All three key defenses are present in the current code: AopUtils.getMostSpecificMethod correctly processes proxy classes, AnnotationMethodMatcher has the proxy early-return check, and CacheAspectSupport properly resolves target methods for proxy classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:32:17.496522+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.1.18.RELEASE. The upstream fix (commits 91b803a2, 0e28bee0, 13356a7e from March 2018) was already included in the 5.1.18.RELEASE when it shipped (September 2020), over 2 years after the patches. The defenses are present in both servlet (spring-webmvc) and reactive (spring-webflux) implementations: PathResourceR...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.1.18.RELEASE. The upstream fix (commits 91b803a2, 0e28bee0, 13356a7e from March 2018) was already included in the 5.1.18.RELEASE when it shipped (September 2020), over 2 years after the patches. The defenses are present in both servlet (spring-webmvc) and reactive (spring-webflux) implementations: PathResourceR..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 is NOT present in Spring Framework 5.1.18.RELEASE. The vulnerability concerns predictable multipart boundary generation using weak Random, allowing attackers to inject additional multipart sections. The target uses SecureRandom (commit 847202c) for boundary generation via lazy initialization in MimeTypeUtils.initRandom() (line 364), making boundaries cryptographically unpredictable. This fix was introduced upstream in v5.1.0.RC1 and was already present in the 5.1.18.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in Spring Framework 5.1.18.RELEASE. The vulnerability concerns predictable multipart boundary generation using weak Random, allowing attackers to inject additional multipart sections. The target uses SecureRandom (commit 847202c) for boundary generation via lazy initialization in MimeTypeUtils.initRandom() (line 364), making boundaries cryptographically unpredictable. This fix was introduced upstream in v5.1.0.RC1 and was already present in the 5.1.18.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:45:05.549046+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.1.18.RELEASE. The upstream fix (commit 423aa28ed5) was already included in the 5.1.18.RELEASE version that TuxCare onboarded. Both required defenses are present: (1) MAX_RANGES=100 limit on number of ranges in parseRanges() at line 135-137, and (2) validation that sum of overlapping ranges < resource length in toResourceRegions() at lines 184-194. The fix was authored by upstream Spring developer rstoyanchev@pivotal.io and shipped in the upstream release, not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.1.18.RELEASE. The upstream fix (commit 423aa28ed5) was already included in the 5.1.18.RELEASE version that TuxCare onboarded. Both required defenses are present: (1) MAX_RANGES=100 limit on number of ranges in parseRanges() at line 135-137, and (2) validation that sum of overlapping ranges < resource length in toResourceRegions() at lines 184-194. The fix was authored by upstream Spring developer rstoyanchev@pivotal.io and shipped in the upstream release, not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:32:17.496522+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:32:17.496522+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:25:00.091559+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable URI-cache comparison code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124 and :142, handler and CORS lookups directly iterate handler mappings without cached-result matching, and the class contains no CachedResult or cache setup methods.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable URI-cache comparison code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124 and :142, handler and CORS lookups directly iterate handler mappings without cached-result matching, and the class contains no CachedResult or cache setup methods."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:32:17.496522+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.18.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:32:17.496522+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}