{
  "@id": "urn:uuid:00ea9fd8-9399-4151-a950-9904f288a299",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 52,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:22:31.962159+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T12:01:12.972757+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in java.util.regex.Pattern.compile affecting JDK versions before 1.6. While Spring Framework 5.1.20.RELEASE contains the PatternEditor code that calls Pattern.compile without validation, the target requires Java 8 (JDK 1.8) per build.gradle sourceCompatibility settings. The CVE explicitly states \"JDK before 1.6\" is vulnerable, meaning JDK...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in java.util.regex.Pattern.compile affecting JDK versions before 1.6. While Spring Framework 5.1.20.RELEASE contains the PatternEditor code that calls Pattern.compile without validation, the target requires Java 8 (JDK 1.8) per build.gradle sourceCompatibility settings. The CVE explicitly states \"JDK before 1.6\" is vulnerable, meaning JDK..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T17:29:00.077200+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.20.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.20.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T09:33:20.113674+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 due to unsafe deserialization of Java Proxy classes. The fix (commit 7d8aa05c40) was authored by upstream vendor Juergen Hoeller and shipped in Spring Framework 3.1.0.RC1 (July 2011). The target version 5.1.20.RELEASE (2019) contains this fix. All three patched files (ConfigurableObjectInputStream, RemoteInvocationSerializingExporter, CodebaseA...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 due to unsafe deserialization of Java Proxy classes. The fix (commit 7d8aa05c40) was authored by upstream vendor Juergen Hoeller and shipped in Spring Framework 3.1.0.RC1 (July 2011). The target version 5.1.20.RELEASE (2019) contains this fix. All three patched files (ConfigurableObjectInputStream, RemoteInvocationSerializingExporter, CodebaseA..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.1.20.RELEASE-tuxcare.7 is not affected by CVE-2014-3578. The vulnerability was fixed in the upstream Spring Framework by commit 8ee465103850a3dca018273fe5952e40d5c45a66 (dated 2014-05-15) by Rossen Stoyanchev, and this fix was already present in the upstream 5.1.20.RELEASE when TuxCare onboarded it. The fix prevents directory traversal by rejecting path prefixes co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.1.20.RELEASE-tuxcare.7 is not affected by CVE-2014-3578. The vulnerability was fixed in the upstream Spring Framework by commit 8ee465103850a3dca018273fe5952e40d5c45a66 (dated 2014-05-15) by Rossen Stoyanchev, and this fix was already present in the upstream 5.1.20.RELEASE when TuxCare onboarded it. The fix prevents directory traversal by rejecting path prefixes co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T19:06:19.212631+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5 where the SockJS client used AlternativeJdkIdGenerator for session ID generation, which used SecureRandom only for the initial seed and then java.util.Random thereafter, making session IDs predictable. The target version 5.1.20.RELEASE uses JdkIdGenerator with UUID.randomUUID(), which uses SecureRandom for every ID generation. The fix w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5 where the SockJS client used AlternativeJdkIdGenerator for session ID generation, which used SecureRandom only for the initial seed and then java.util.Random thereafter, making session IDs predictable. The target version 5.1.20.RELEASE uses JdkIdGenerator with UUID.randomUUID(), which uses SecureRandom for every ID generation. The fix w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:54:30.943101+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack via malicious URL extensions and JSONP callback injection) is NOT AFFECTED in Spring Framework 5.1.20.RELEASE. The vulnerability targeted two attack vectors: (1) path extension manipulation via query/fragment/path-parameters to trick browsers into downloading responses as executable files, and (2) unvalidated JSONP callback parameters containing shell metacharacters. Both attack vectors are neutralized in this version: JSONP support was completely removed from Spring 5.x (commit ac37b678a3, 2018-06-07), eliminating the callback injection vector entirely. The path extension defense logic from the original CVE-2015-5211 fix (proper handling of ?, #, and ; delimiters) is present in UriUtils.extractFileExtension (lines 368-378) and is called by PathExtensionContentNegotiationStrategy for content negotiation. All fixes were authored by upstream Spring developers and shipped with the 5.1.20.RELEASE before TuxCare onboarding (first TuxCare commit: cad3646bcd).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack via malicious URL extensions and JSONP callback injection) is NOT AFFECTED in Spring Framework 5.1.20.RELEASE. The vulnerability targeted two attack vectors: (1) path extension manipulation via query/fragment/path-parameters to trick browsers into downloading responses as executable files, and (2) unvalidated JSONP callback parameters containing shell metacharacters. Both attack vectors are neutralized in this version: JSONP support was completely removed from Spring 5.x (commit ac37b678a3, 2018-06-07), eliminating the callback injection vector entirely. The path extension defense logic from the original CVE-2015-5211 fix (proper handling of ?, #, and ; delimiters) is present in UriUtils.extractFileExtension (lines 368-378) and is called by PathExtensionContentNegotiationStrategy for content negotiation. All fixes were authored by upstream Spring developers and shipped with the 5.1.20.RELEASE before TuxCare onboarding (first TuxCare commit: cad3646bcd).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:07:28.836714+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.1.20.RELEASE. The vulnerability involved AntPathMatcher incorrectly matching URL paths containing spaces to patterns without spaces when trimTokens=true (default in vulnerable versions), allowing authorization bypass. The upstream fix (commit 3c92ddc94b by Brian Clozel, May 2016) changed the default to trimTokens=false and modified isPotentialMatch() to disable optimizations when trimming is enabled. This fix was already included in the upstream 5.1.20.RELEASE that TuxCare onboarded (first TuxCare commit cad3646b \"Setup for spring framework 5.1.20.RELEASE\"). The vulnerable pattern (trimTokens=true default) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.1.20.RELEASE. The vulnerability involved AntPathMatcher incorrectly matching URL paths containing spaces to patterns without spaces when trimTokens=true (default in vulnerable versions), allowing authorization bypass. The upstream fix (commit 3c92ddc94b by Brian Clozel, May 2016) changed the default to trimTokens=false and modified isPotentialMatch() to disable optimizations when trimming is enabled. This fix was already included in the upstream 5.1.20.RELEASE that TuxCare onboarded (first TuxCare commit cad3646b \"Setup for spring framework 5.1.20.RELEASE\"). The vulnerable pattern (trimTokens=true default) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:39.156684+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2018-11040 describes a JSONP vulnerability in Spring Framework that allowed cross-domain data exfiltration via automatic JSONP wrapping when HTTP requests contained \"jsonp\" or \"callback\" query parameters. The target version 5.1.20.RELEASE is NOT affected because the entire JSONP functionality was completely removed from Spring Framework 5.1.x by upstream commit ac37b678a3 (June 2018), which shipped in the upstream 5.1.20.RELEASE that TuxCare onboarded. The vulnerable code (MappingJackson2JsonView JSONP processing, AbstractJsonpResponseBodyAdvice, JsonpPollingTransportHandler, JsonpReceivingTransportHandler) does not exist in the target repository. The removal was authored by Sebastien Deleuze (sdeleuze@pivotal.io) and predates the first TuxCare commit (cad3646bcd, Oct 2025) by over 7 years, confirming it was part of the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 describes a JSONP vulnerability in Spring Framework that allowed cross-domain data exfiltration via automatic JSONP wrapping when HTTP requests contained \"jsonp\" or \"callback\" query parameters. The target version 5.1.20.RELEASE is NOT affected because the entire JSONP functionality was completely removed from Spring Framework 5.1.x by upstream commit ac37b678a3 (June 2018), which shipped in the upstream 5.1.20.RELEASE that TuxCare onboarded. The vulnerable code (MappingJackson2JsonView JSONP processing, AbstractJsonpResponseBodyAdvice, JsonpPollingTransportHandler, JsonpReceivingTransportHandler) does not exist in the target repository. The removal was authored by Sebastien Deleuze (sdeleuze@pivotal.io) and predates the first TuxCare commit (cad3646bcd, Oct 2025) by over 7 years, confirming it was part of the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T00:52:21.627845+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.1.20.RELEASE. The vulnerability allowed bypassing security constraints via URL path parameters with special encodings (backslashes, duplicate slashes, encoded traversal sequences like %2F%2F%2E%2E). The upstream fix (SPR-16616, commits 91b803a231 and 0e28bee0f1 from March 2018) adds comprehensive path normalization and encoded path validation t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.1.20.RELEASE. The vulnerability allowed bypassing security constraints via URL path parameters with special encodings (backslashes, duplicate slashes, encoded traversal sequences like %2F%2F%2E%2E). The upstream fix (SPR-16616, commits 91b803a231 and 0e28bee0f1 from March 2018) adds comprehensive path normalization and encoded path validation t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T08:55:17.845672+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions prior to 5.0.6 and 4.3.17, addressing a regex denial of service vulnerability in STOMP over WebSocket selector header parsing. The target version 5.1.20.RELEASE was released December 9, 2020, well after the fix was introduced in April 2018 (versions 4.3.17 and 5.0.6). The fix is present in the target code at the time of TuxCare onboarding - the vu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions prior to 5.0.6 and 4.3.17, addressing a regex denial of service vulnerability in STOMP over WebSocket selector header parsing. The target version 5.1.20.RELEASE was released December 9, 2020, well after the fix was introduced in April 2018 (versions 4.3.17 and 5.0.6). The fix is present in the target code at the time of TuxCare onboarding - the vu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2018-1258 does not affect Spring Framework 5.1.20.RELEASE. The vulnerability, an authorization bypass when using method security with JDK dynamic proxies, was fixed upstream on April 27, 2018 (commits aa11721ff0 and eaff2c28a7). These fixes were included in Spring Framework 5.1.0.RC1 and all subsequent 5.1.x releases, including 5.1.20.RELEASE (released September 2020). TuxCare onboarded this version with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 does not affect Spring Framework 5.1.20.RELEASE. The vulnerability, an authorization bypass when using method security with JDK dynamic proxies, was fixed upstream on April 27, 2018 (commits aa11721ff0 and eaff2c28a7). These fixes were included in Spring Framework 5.1.0.RC1 and all subsequent 5.1.x releases, including 5.1.20.RELEASE (released September 2020). TuxCare onboarded this version with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T18:22:00.126197+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.1.20.RELEASE is not affected by CVE-2018-1271. The vulnerability pattern (missing URL-decoding and backslash normalization before directory traversal validation) is not present because the upstream fix was already included in Spring Framework 5.1.0.RELEASE, which predates the 5.1.20.RELEASE version. The fix was authored by Juergen Hoeller (jhoeller@pivotal.io) from...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.1.20.RELEASE is not affected by CVE-2018-1271. The vulnerability pattern (missing URL-decoding and backslash normalization before directory traversal validation) is not present because the upstream fix was already included in Spring Framework 5.1.0.RELEASE, which predates the 5.1.20.RELEASE version. The fix was authored by Juergen Hoeller (jhoeller@pivotal.io) from..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15, where predictable Random-based multipart boundary generation enables attackers to inject malicious multipart parts in forwarded requests, potentially leading to privilege escalation. The vulnerability allows an attacker to predict the boundary string that server A will use when forwarding a multipart request to server B, enabling injection of fake multipart parts that override legitimate values (e.g., username or user roles). The target version 5.1.20.RELEASE already contains the upstream fix committed by Rossen Stoyanchev (rstoyanchev@pivotal.io) on March 23, 2018, which replaces insecure Random with SecureRandom for boundary generation. This fix was part of the upstream release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15, where predictable Random-based multipart boundary generation enables attackers to inject malicious multipart parts in forwarded requests, potentially leading to privilege escalation. The vulnerability allows an attacker to predict the boundary string that server A will use when forwarding a multipart request to server B, enabling injection of fake multipart parts that override legitimate values (e.g., username or user roles). The target version 5.1.20.RELEASE already contains the upstream fix committed by Rossen Stoyanchev (rstoyanchev@pivotal.io) on March 23, 2018, which replaces insecure Random with SecureRandom for boundary generation. This fix was part of the upstream release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:31:13.211032+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.1.20.RELEASE. The vulnerability concerns DoS attacks via malicious HTTP Range headers with excessive ranges or overlapping ranges. The upstream fix (commit 423aa28ed5) was already included in the v5.1.20.RELEASE tag before TuxCare onboarded this version. The fix adds a MAX_RANGES=100 limit and validates that the sum of all range lengths doesn't equal or exceed the resource length. Both protections are present in the target code at spring-web/src/main/java/org/springframework/http/HttpRange.java lines 47-48, 135-137, and 184-194.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.1.20.RELEASE. The vulnerability concerns DoS attacks via malicious HTTP Range headers with excessive ranges or overlapping ranges. The upstream fix (commit 423aa28ed5) was already included in the v5.1.20.RELEASE tag before TuxCare onboarded this version. The fix adds a MAX_RANGES=100 limit and validates that the sum of all range lengths doesn't equal or exceed the resource length. Both protections are present in the target code at spring-web/src/main/java/org/springframework/http/HttpRange.java lines 47-48, 135-137, and 184-194.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:31.962159+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI matching code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124, handler lookup directly iterates handler mappings without consulting cached request URIs; the class has no CachedResult, cache filter, or request-URI regular-expression comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI matching code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124, handler lookup directly iterates handler mappings without consulting cached request URIs; the class has no CachedResult, cache filter, or request-URI regular-expression comparison."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.20.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core, and is fixed in 5.1.20.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-core, and is fixed in 5.1.20.RELEASE-tuxcare.5."
    }
  ]
}