{
  "@id": "urn:uuid:7f4c9428-6436-4102-8476-27689a00a1a0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:37:00.050625+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T12:34:56.763245+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.9.RELEASE is not affected by CVE-2009-1190. The vulnerability is an algorithmic complexity issue in java.util.regex.Pattern.compile in JDK versions before 1.6, where regex patterns with multiple optional groups can cause CPU exhaustion. Spring Framework 5.1.9.RELEASE requires Java 8 (sourceCompatibility = 1.8), which includes the JDK 1.6+ fix for this vulnerability. The run...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.9.RELEASE is not affected by CVE-2009-1190. The vulnerability is an algorithmic complexity issue in java.util.regex.Pattern.compile in JDK versions before 1.6, where regex patterns with multiple optional groups can cause CPU exhaustion. Spring Framework 5.1.9.RELEASE requires Java 8 (sourceCompatibility = 1.8), which includes the JDK 1.6+ fix for this vulnerability. The run..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T17:37:00.050625+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.9.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.9.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T09:47:00.137511+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0 through 3.0.5. The target version 5.1.9.RELEASE (released July 2019) is outside the affected version range. The upstream vendor fix, added in July 2011, introduces an `acceptProxyClasses` flag that controls whether proxy class deserialization is permitted. This defense mechanism is present in all three affected files (ConfigurableObjectInputStream, C...",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0 through 3.0.5. The target version 5.1.9.RELEASE (released July 2019) is outside the affected version range. The upstream vendor fix, added in July 2011, introduces an `acceptProxyClasses` flag that controls whether proxy class deserialization is permitted. This defense mechanism is present in all three affected files (ConfigurableObjectInputStream, C..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target version 5.1.9.RELEASE already contains the upstream fix (commit 8ee4651038 by Rossen Stoyanchev, dated May 15, 2014). The fix adds validation to StringUtils.cleanPath() that rejects URI prefixes containing \"/\" characters, preventing directory traversal via malicious path patterns like \"/a/:b/../../secret\". ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target version 5.1.9.RELEASE already contains the upstream fix (commit 8ee4651038 by Rossen Stoyanchev, dated May 15, 2014). The fix adds validation to StringUtils.cleanPath() that rejects URI prefixes containing \"/\" characters, preventing directory traversal via malicious path patterns like \"/a/:b/../../secret\". ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:13:01.149696+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS Java client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then weaker Random thereafter). The vulnerability was fixed in upstream commit 52b8f34 (Jan 2015) by switching to JdkIdGenerator with cryptographically secure UUID.randomUUID(). Target version 5.1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS Java client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then weaker Random thereafter). The vulnerability was fixed in upstream commit 52b8f34 (Jan 2015) by switching to JdkIdGenerator with cryptographically secure UUID.randomUUID(). Target version 5.1..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) does NOT affect Spring Framework 5.1.9.RELEASE. The upstream vendor fix (commit 2bd1daa75e from Oct 2015) shipped in the release before TuxCare onboarding. Additionally, the primary attack vector (JSONP callback reflection) is architecturally absent - JSONP support was removed in Spring 5.x. The MappingJacksonValue class no longer has jsonpFunction methods, eliminating the ability to reflect arbitrary user-controlled callback values in JSON responses. The Content-Disposition defense for non-whitelisted file extensions is present in AbstractMessageConverterMethodProcessor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) does NOT affect Spring Framework 5.1.9.RELEASE. The upstream vendor fix (commit 2bd1daa75e from Oct 2015) shipped in the release before TuxCare onboarding. Additionally, the primary attack vector (JSONP callback reflection) is architecturally absent - JSONP support was removed in Spring 5.x. The MappingJacksonValue class no longer has jsonpFunction methods, eliminating the ability to reflect arbitrary user-controlled callback values in JSON responses. The Content-Disposition defense for non-whitelisted file extensions is present in AbstractMessageConverterMethodProcessor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:15:34.961054+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. Spring Framework 5.1.9.RELEASE is not affected by CVE-2016-5007. The vulnerability concerns pattern matching discrepancies between Spring Security's authorization checks and Spring MVC's controller routing, which could allow attackers to bypass security checks. The fix (HandlerMappingIntrospector API with MatchableHandlerMapping interface) was introduced in Spring Framework 4.3.1 via upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by Rossen Stoyanchev. This fix was already present in the upstream Spring Framework 5.1.9.RELEASE when TuxCare onboarded it (commit 42f343561d). Both AbstractUrlHandlerMapping and RequestMappingHandlerMapping implement MatchableHandlerMapping with match() methods that expose the exact same PathMatcher and matching logic used internally for routing, enabling Spring Security to verify authorization patterns using identical matching behavior. The vulnerable pattern (lack of introspection API) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.1.9.RELEASE is not affected by CVE-2016-5007. The vulnerability concerns pattern matching discrepancies between Spring Security's authorization checks and Spring MVC's controller routing, which could allow attackers to bypass security checks. The fix (HandlerMappingIntrospector API with MatchableHandlerMapping interface) was introduced in Spring Framework 4.3.1 via upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by Rossen Stoyanchev. This fix was already present in the upstream Spring Framework 5.1.9.RELEASE when TuxCare onboarded it (commit 42f343561d). Both AbstractUrlHandlerMapping and RequestMappingHandlerMapping implement MatchableHandlerMapping with match() methods that expose the exact same PathMatcher and matching logic used internally for routing, enabling Spring Security to verify authorization patterns using identical matching behavior. The vulnerable pattern (lack of introspection API) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:57:09.327261+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. The target Spring Framework 5.1.9.RELEASE is not affected by CVE-2018-11040. The vulnerable JSONP support code was completely removed by upstream Spring Framework in commit ac37b678a3 (June 7, 2018) before the 5.1.0 release. This removal was already present in the upstream 5.1.9.RELEASE when TuxCare onboarded it. The JSONP functionality that automatically enabled cross-domain requests through \"jsonp\" and \"callback\" parameters no longer exists in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target Spring Framework 5.1.9.RELEASE is not affected by CVE-2018-11040. The vulnerable JSONP support code was completely removed by upstream Spring Framework in commit ac37b678a3 (June 7, 2018) before the 5.1.0 release. This removal was already present in the upstream 5.1.9.RELEASE when TuxCare onboarded it. The JSONP functionality that automatically enabled cross-domain requests through \"jsonp\" and \"callback\" parameters no longer exists in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T01:06:00.110833+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 fix was already present in upstream Spring Framework 5.1.9.RELEASE when TuxCare onboarded it. The vulnerability involved bypassing security constraints via URL path parameters with special encodings (encoded dots/slashes/backslashes) that were not properly normalized. The fix (commit 91b803a231 by jhoeller@pivotal.io, dated 2018-03-21) adds comprehensive path normalization and val...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 fix was already present in upstream Spring Framework 5.1.9.RELEASE when TuxCare onboarded it. The vulnerability involved bypassing security constraints via URL path parameters with special encodings (encoded dots/slashes/backslashes) that were not properly normalized. The fix (commit 91b803a231 by jhoeller@pivotal.io, dated 2018-03-21) adds comprehensive path normalization and val..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework STOMP over WebSocket selector functionality, allowing ReDoS attacks via crafted SpEL expressions. The fix (SPR-16732, commit ff2228fdaf1) was authored by Rossen Stoyanchev (upstream Spring team) on April 16, 2018, and shipped in Spring Framework 5.0.6, 5.1.0, and 5.1.9.RELEASE. The target version 5.1.9.RELEASE was onboarded by TuxCare on July 21, 2026 with...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework STOMP over WebSocket selector functionality, allowing ReDoS attacks via crafted SpEL expressions. The fix (SPR-16732, commit ff2228fdaf1) was authored by Rossen Stoyanchev (upstream Spring team) on April 16, 2018, and shipped in Spring Framework 5.0.6, 5.1.0, and 5.1.9.RELEASE. The target version 5.1.9.RELEASE was onboarded by TuxCare on July 21, 2026 with..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2018-1258 is NOT present in Spring Framework 5.1.9.RELEASE. The vulnerability was fixed by upstream Spring Framework developers in commit aa11721ff0 (April 2018, addressing SPR-16757), which shipped in the 5.1.9.RELEASE before TuxCare onboarded it. All three key defensive changes are present: (1) AopUtils.getMostSpecificMethod() no longer excludes proxy classes, (2) AnnotationMethodMatcher.matches() adds early return for proxy classes, and (3) AspectJExpressionPointcut handles proxy class method matching correctly. The fix prevents authorization bypass by ensuring method-level security annotations are properly evaluated on the actual target method rather than on proxy-redeclared methods (which lack annotations).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is NOT present in Spring Framework 5.1.9.RELEASE. The vulnerability was fixed by upstream Spring Framework developers in commit aa11721ff0 (April 2018, addressing SPR-16757), which shipped in the 5.1.9.RELEASE before TuxCare onboarded it. All three key defensive changes are present: (1) AopUtils.getMostSpecificMethod() no longer excludes proxy classes, (2) AnnotationMethodMatcher.matches() adds early return for proxy classes, and (3) AspectJExpressionPointcut handles proxy class method matching correctly. The fix prevents authorization bypass by ensuring method-level security annotations are properly evaluated on the actual target method rather than on proxy-redeclared methods (which lack annotations).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T18:49:00.097226+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is not present in Spring Framework 5.1.9.RELEASE. The upstream security fixes (commits 0e28bee0, f59ea610, 13356a7e from March 2018) were already part of the 5.1.9.RELEASE when it was released in August 2019. The target contains all protective mechanisms: path normalization (backslash-to-forward-slash conversion, duplicate slash removal) and trave...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is not present in Spring Framework 5.1.9.RELEASE. The upstream security fixes (commits 0e28bee0, f59ea610, 13356a7e from March 2018) were already part of the 5.1.9.RELEASE when it was released in August 2019. The target contains all protective mechanisms: path normalization (backslash-to-forward-slash conversion, duplicate slash removal) and trave..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:11.887724+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2018-1272 is NOT present in Spring Framework 5.1.9.RELEASE. The vulnerability involved using weak Random for multipart boundary generation, allowing attackers to predict boundaries and inject forged multipart markers. The upstream fix (commit ab2410c754) replaced Random with SecureRandom, and this fix was already shipped in the upstream v5.1.9.RELEASE before TuxCare onboarded it. All production multipart code uses the fixed MimeTypeUtils.generateMultipartBoundary() method with SecureRandom.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in Spring Framework 5.1.9.RELEASE. The vulnerability involved using weak Random for multipart boundary generation, allowing attackers to predict boundaries and inject forged multipart markers. The upstream fix (commit ab2410c754) replaced Random with SecureRandom, and this fix was already shipped in the upstream v5.1.9.RELEASE before TuxCare onboarded it. All production multipart code uses the fixed MimeTypeUtils.generateMultipartBoundary() method with SecureRandom.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:39:52.216680+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2018-15756 is not present in Spring Framework 5.1.9.RELEASE. The upstream vendor (Spring Framework) fixed this vulnerability in commit 423aa28ed5 (Oct 3, 2018) by adding MAX_RANGES=100 limit and range sum validation. This fix was already included in the upstream 5.1.9.RELEASE before TuxCare onboarded it (commit 42f343561d by askorik@cloudlinux.com). The vulnerable pattern (unlimited range parsing and overlapping range processing) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is not present in Spring Framework 5.1.9.RELEASE. The upstream vendor (Spring Framework) fixed this vulnerability in commit 423aa28ed5 (Oct 3, 2018) by adding MAX_RANGES=100 limit and range sum validation. This fix was already included in the upstream 5.1.9.RELEASE before TuxCare onboarded it (commit 42f343561d by askorik@cloudlinux.com). The vulnerable pattern (unlimited range parsing and overlapping range processing) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T03:39:22.988337+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.9.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-02T14:59:00.710097+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core, and is fixed in 5.1.9.RELEASE-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core, and is fixed in 5.1.9.RELEASE-tuxcare.6."
    }
  ]
}