{
  "@id": "urn:uuid:94ff3d7f-d140-4543-b9fb-099e6b43e905",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:27:46.722408+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T11:54:00.134869+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.0.RELEASE is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile() that exists only in JDK versions before 1.6. Spring Framework 5.2.0 requires JDK 8+ as its minimum runtime environment (confirmed in CompilerConventionsPlugin.java). Since JDK 1.6+ fixed the underlying Pattern.compile algorithmic comple...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.0.RELEASE is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile() that exists only in JDK versions before 1.6. Spring Framework 5.2.0 requires JDK 8+ as its minimum runtime environment (confirmed in CompilerConventionsPlugin.java). Since JDK 1.6+ fixed the underlying Pattern.compile algorithmic comple..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:27:46.722408+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.0.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.0.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:32:14.158159+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target version 5.2.0.RELEASE-tuxcare.8 is NOT AFFECTED by CVE-2011-2894. The vulnerability (unrestricted proxy class deserialization enabling arbitrary code execution) was fixed by upstream Spring Framework maintainer Juergen Hoeller on July 21, 2011 (commit 7d8aa05c40). The fix adds an acceptProxyClasses flag to ConfigurableObjectInputStream that, when set to false, throws NotSerializableExcep...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Target version 5.2.0.RELEASE-tuxcare.8 is NOT AFFECTED by CVE-2011-2894. The vulnerability (unrestricted proxy class deserialization enabling arbitrary code execution) was fixed by upstream Spring Framework maintainer Juergen Hoeller on July 21, 2011 (commit 7d8aa05c40). The fix adds an acceptProxyClasses flag to ConfigurableObjectInputStream that, when set to false, throws NotSerializableExcep..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in spring-framework 5.2.0.RELEASE-tuxcare.8. The upstream fix (commit 8ee4651038) was already included in v5.2.0.RELEASE before TuxCare onboarding. The fix adds validation to StringUtils.cleanPath() that rejects path prefixes containing forward slashes, preventing colons embedded within path segments from being misinterpreted as sch...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in spring-framework 5.2.0.RELEASE-tuxcare.8. The upstream fix (commit 8ee4651038) was already included in v5.2.0.RELEASE before TuxCare onboarding. The fix adds validation to StringUtils.cleanPath() that rejects path prefixes containing forward slashes, preventing colons embedded within path segments from being misinterpreted as sch..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:03:28.719515+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then predictable Random). The target version 5.2.0.RELEASE contains the upstream fix (commit 52b8f34) that replaced AlternativeJdkIdGenerator with JdkIdGenerator, which uses UUID.randomUUID() (cry...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then predictable Random). The target version 5.2.0.RELEASE contains the upstream fix (commit 52b8f34) that replaced AlternativeJdkIdGenerator with JdkIdGenerator, which uses UUID.randomUUID() (cry..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:52:09.053481+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.2.0.RELEASE. The vulnerability was fixed upstream in October 2015 (commit 2bd1daa75e by Rossen Stoyanchev), years before the 5.2.0.RELEASE was published in September 2019. The fix was already included in the upstream release that TuxCare onboarded. The defense mechanism (Content-Disposition header protection for unsafe file extensions) is present and active in AbstractMessageConverterMethodProcessor.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.2.0.RELEASE. The vulnerability was fixed upstream in October 2015 (commit 2bd1daa75e by Rossen Stoyanchev), years before the 5.2.0.RELEASE was published in September 2019. The fix was already included in the upstream release that TuxCare onboarded. The defense mechanism (Content-Disposition header protection for unsafe file extensions) is present and active in AbstractMessageConverterMethodProcessor.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:04:07.366670+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.2.0.RELEASE. The vulnerability concerns URL pattern matching discrepancies between Spring Security and Spring Framework that could lead to authorization bypass. The fix, which introduces the MatchableHandlerMapping interface and HandlerMappingIntrospector helper class to provide unified pattern matching API, was already included in the upstream 5.2.0.RELEASE before TuxCare onboarded it. The defense mechanism is fully implemented in the target at commit 16949941f8 by upstream developer Juergen Hoeller.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.2.0.RELEASE. The vulnerability concerns URL pattern matching discrepancies between Spring Security and Spring Framework that could lead to authorization bypass. The fix, which introduces the MatchableHandlerMapping interface and HandlerMappingIntrospector helper class to provide unified pattern matching API, was already included in the upstream 5.2.0.RELEASE before TuxCare onboarded it. The defense mechanism is fully implemented in the target at commit 16949941f8 by upstream developer Juergen Hoeller.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:02.040973+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.2.0.RELEASE is not affected by CVE-2018-11040. The vulnerable JSONP support code was completely removed from Spring Framework upstream before version 5.2.0.RELEASE was released. The removal occurred in commit ac37b678a3 (June 7, 2018) by upstream maintainer Sebastien Deleuze, well before the 5.2.0.RELEASE tag (September 30, 2019). The target version never contained the vulnerable default JSONP parameter names (\"jsonp\", \"callback\") in MappingJackson2JsonView, as this entire feature was removed in favor of CORS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.2.0.RELEASE is not affected by CVE-2018-11040. The vulnerable JSONP support code was completely removed from Spring Framework upstream before version 5.2.0.RELEASE was released. The removal occurred in commit ac37b678a3 (June 7, 2018) by upstream maintainer Sebastien Deleuze, well before the 5.2.0.RELEASE tag (September 30, 2019). The target version never contained the vulnerable default JSONP parameter names (\"jsonp\", \"callback\") in MappingJackson2JsonView, as this entire feature was removed in favor of CORS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T00:50:41.219686+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.0.RELEASE is not affected by CVE-2018-1199. The vulnerability was fixed in upstream releases (5.0.3 for 5.0.x branch, 4.3.14 for 4.3.x branch) before version 5.2.0.RELEASE was released. All fix commits (SPR-16296, SPR-16526, SPR-16616) addressing path normalization, duplicate slash cleaning, and encoded path validation are present in the target and were authored by upstream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.0.RELEASE is not affected by CVE-2018-1199. The vulnerability was fixed in upstream releases (5.0.3 for 5.0.x branch, 4.3.14 for 4.3.x branch) before version 5.2.0.RELEASE was released. All fix commits (SPR-16296, SPR-16526, SPR-16616) addressing path normalization, duplicate slash cleaning, and encoded path validation are present in the target and were authored by upstream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T08:49:57.907521+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions that allow unconditional parsing of SpEL selector expressions in STOMP WebSocket subscriptions, leading to potential ReDoS attacks. The target version 5.2.0.RELEASE contains the upstream fix (commit ff2228fdaf, dated 2018-04-16) that wraps selector parsing in a null check and allows administrators to disable the feature. This fix was included in S...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions that allow unconditional parsing of SpEL selector expressions in STOMP WebSocket subscriptions, leading to potential ReDoS attacks. The target version 5.2.0.RELEASE contains the upstream fix (commit ff2228fdaf, dated 2018-04-16) that wraps selector parsing in a null check and allows administrators to disable the feature. This fix was included in S..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 does not affect Spring Framework 5.2.0.RELEASE-tuxcare.8. The vulnerability (authorization bypass via incorrect proxy method resolution) was fixed in upstream Spring Framework 5.1.0.RC1 (April 2018), well before the 5.2.0.RELEASE (September 2019). The target version contains the upstream vendor's fixes that properly resolve methods on JDK dynamic proxies, ensuring security annotations are discovered and enforced. All fix commits (aa11721ff0, eaff2c28a7) are authored by the upstream Spring maintainer and predate TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 does not affect Spring Framework 5.2.0.RELEASE-tuxcare.8. The vulnerability (authorization bypass via incorrect proxy method resolution) was fixed in upstream Spring Framework 5.1.0.RC1 (April 2018), well before the 5.2.0.RELEASE (September 2019). The target version contains the upstream vendor's fixes that properly resolve methods on JDK dynamic proxies, ensuring security annotations are discovered and enforced. All fix commits (aa11721ff0, eaff2c28a7) are authored by the upstream Spring maintainer and predate TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:15:01.892768+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.0.RELEASE is NOT AFFECTED by CVE-2018-1271. The directory traversal vulnerability fix was already present in the upstream 5.2.0.RELEASE when it was released in September 2019. The fix (commit 91b803a231 by Juergen Hoeller, dated March 21, 2018) predates the 5.2.0.RELEASE by over a year. The target code contains all required defenses: isInvalidEncodedPath() methods that deco...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.0.RELEASE is NOT AFFECTED by CVE-2018-1271. The directory traversal vulnerability fix was already present in the upstream 5.2.0.RELEASE when it was released in September 2019. The fix (commit 91b803a231 by Juergen Hoeller, dated March 21, 2018) predates the 5.2.0.RELEASE by over a year. The target code contains all required defenses: isInvalidEncodedPath() methods that deco..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 is not present in Spring Framework 5.2.0.RELEASE. The vulnerability involves predictable multipart boundaries generated using weak Random(), allowing attackers to inject malicious multipart parts. The upstream fix (commit ab2410c754, SPR-16635) replaced Random() with SecureRandom for boundary generation on March 23, 2018, which was already shipped in Spring 5.2.0.RELEASE before TuxCare onboarded it. The current code uses SecureRandom exclusively for all multipart boundary generation via MimeTypeUtils.generateMultipartBoundary().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is not present in Spring Framework 5.2.0.RELEASE. The vulnerability involves predictable multipart boundaries generated using weak Random(), allowing attackers to inject malicious multipart parts. The upstream fix (commit ab2410c754, SPR-16635) replaced Random() with SecureRandom for boundary generation on March 23, 2018, which was already shipped in Spring 5.2.0.RELEASE before TuxCare onboarded it. The current code uses SecureRandom exclusively for all multipart boundary generation via MimeTypeUtils.generateMultipartBoundary().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:29:29.992370+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 (HTTP Range DoS) is not affecting this target. The fix was already present in the upstream Spring Framework v5.2.0.RELEASE when it was released (September 2019). Commit 423aa28ed5 (dated October 2018) introduced two defenses: (1) limiting HTTP Range header to max 100 ranges, and (2) validating that the sum of all range lengths is less than the resource length. Both defenses are present and functional at spring-web/src/main/java/org/springframework/http/HttpRange.java lines 136-138 and 191-194. The fix was authored by upstream Spring developer Rossen Stoyanchev (rstoyanchev@pivotal.io), not TuxCare, and predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 (HTTP Range DoS) is not affecting this target. The fix was already present in the upstream Spring Framework v5.2.0.RELEASE when it was released (September 2019). Commit 423aa28ed5 (dated October 2018) introduced two defenses: (1) limiting HTTP Range header to max 100 ranges, and (2) validating that the sum of all range lengths is less than the resource length. Both defenses are present and functional at spring-web/src/main/java/org/springframework/http/HttpRange.java lines 136-138 and 191-194. The fix was authored by upstream Spring developer Rossen Stoyanchev (rstoyanchev@pivotal.io), not TuxCare, and predates TuxCare's onboarding of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 is fixed in version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is a false positive for org.springframework:spring-core 5.2.0.RELEASE-tuxcare.2. direct vulnerability is in Spring Framework project - affected versions are spring-core 5.3.0-5.3.44 / 6.0.0-6.1.22 / 6.2.0-6.2.10, version 5.2.0.RELEASE is not in this range",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "impact_statement": "direct vulnerability is in Spring Framework project - affected versions are spring-core 5.3.0-5.3.44 / 6.0.0-6.1.22 / 6.2.0-6.2.10, version 5.2.0.RELEASE is not in this range"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.0.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.0.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.2.0.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.0.RELEASE-tuxcare.5."
    }
  ]
}