{
  "@id": "urn:uuid:7c682737-c53b-45b0-b607-0d55e85f6f9a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 53,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:55:00.104909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:21:00.115979+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes a denial-of-service vulnerability where deserializing objects containing complex regex patterns with multiple optional groups could cause excessive CPU consumption during Pattern.compile. The vulnerability was fixed in upstream Spring Framework commit 9306d6dbaab (April 20, 2009) by changing Pattern fields from transient to non-transient and removing the readObject metho...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes a denial-of-service vulnerability where deserializing objects containing complex regex patterns with multiple optional groups could cause excessive CPU consumption during Pattern.compile. The vulnerability was fixed in upstream Spring Framework commit 9306d6dbaab (April 20, 2009) by changing Pattern fields from transient to non-transient and removing the readObject metho..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:32:38.990328+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.10.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.10.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:43:00.134280+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.10.RELEASE contains the CVE-2011-2894 fix that was added by upstream in July 2011 and shipped in the upstream 5.2.10.RELEASE. The defense mechanism (acceptProxyClasses flag) exists in all three affected classes (ConfigurableObjectInputStream, CodebaseAwareObjectInputStream, RemoteInvocationSerializingExporter) but is DISABLED BY DEFAULT (acceptProxyClasses=true means proxy ...",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.10.RELEASE contains the CVE-2011-2894 fix that was added by upstream in July 2011 and shipped in the upstream 5.2.10.RELEASE. The defense mechanism (acceptProxyClasses flag) exists in all three affected classes (ConfigurableObjectInputStream, CodebaseAwareObjectInputStream, RemoteInvocationSerializingExporter) but is DISABLED BY DEFAULT (acceptProxyClasses=true means proxy ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability fix was already present in upstream Spring Framework 5.2.10.RELEASE when TuxCare onboarded it. The vulnerable code pattern (improper prefix extraction allowing path traversal via crafted URLs like `/a/:b/../../file`) is not present. The fix commit 8ee4651038 by Rossen Stoyanchev (upstream Spring, May 2014) predates the first TuxCare commit f5348de...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability fix was already present in upstream Spring Framework 5.2.10.RELEASE when TuxCare onboarded it. The vulnerable code pattern (improper prefix extraction allowing path traversal via crafted URLs like `/a/:b/../../file`) is not present. The fix commit 8ee4651038 by Rossen Stoyanchev (upstream Spring, May 2014) predates the first TuxCare commit f5348de..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:12:03.186793+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects the Java SockJS client in Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation. The vulnerability was fixed in upstream Spring Framework 4.1.5 (January 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator for SockJS session ID generation. The target version 5.2.10.RELEASE already contains this upstream fix - SockJsUrlInfo uses JdkIdGener...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects the Java SockJS client in Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation. The vulnerability was fixed in upstream Spring Framework 4.1.5 (January 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator for SockJS session ID generation. The target version 5.2.10.RELEASE already contains this upstream fix - SockJsUrlInfo uses JdkIdGener..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:00:16.038874+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download vulnerability) is not present in Spring Framework 5.2.10.RELEASE. The upstream vendor (Pivotal/Spring) fixed this vulnerability before the 5.2.10.RELEASE was published, and the fix was already included in the upstream release when TuxCare onboarded this version. All key RFD protections are present: Content-Disposition header enforcement for unsafe file extensions, JSONP callback validation, and path parameter sanitization in SockJS handlers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download vulnerability) is not present in Spring Framework 5.2.10.RELEASE. The upstream vendor (Pivotal/Spring) fixed this vulnerability before the 5.2.10.RELEASE was published, and the fix was already included in the upstream release when TuxCare onboarded this version. All key RFD protections are present: Content-Disposition header enforcement for unsafe file extensions, JSONP callback validation, and path parameter sanitization in SockJS handlers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2016-5007 affects Spring Framework versions 3.2.x, 4.0.x, 4.1.x, and 4.2.x. The target version 5.2.10.RELEASE (released in 2020) is significantly newer and already contains the upstream fix from May 2016. The vulnerability involved inconsistent path matching between Spring Security and Spring MVC due to automatic whitespace trimming in path segments. The fix changed AntPathMatcher's trimTokens default from true to false, making path matching stricter. This fix (commit 3c92ddc94b by bclozel@pivotal.io) was already present in the upstream release before TuxCare onboarded version 5.2.10.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 affects Spring Framework versions 3.2.x, 4.0.x, 4.1.x, and 4.2.x. The target version 5.2.10.RELEASE (released in 2020) is significantly newer and already contains the upstream fix from May 2016. The vulnerability involved inconsistent path matching between Spring Security and Spring MVC due to automatic whitespace trimming in path segments. The fix changed AntPathMatcher's trimTokens default from true to false, making path matching stricter. This fix (commit 3c92ddc94b by bclozel@pivotal.io) was already present in the upstream release before TuxCare onboarded version 5.2.10.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:54:41.040148+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. Spring Framework 5.2.10.RELEASE is not affected by CVE-2018-11040. The vulnerability concerned automatic JSONP support in MappingJackson2JsonView that enabled cross-domain requests through default parameter names \"jsonp\" and \"callback\". However, the entire JSONP feature was completely removed from Spring Framework in version 5.1.0.RC1 (June 2018) by upstream commit ac37b678a3. Since the target version 5.2.10.RELEASE is subsequent to 5.1.0, no JSONP code exists in the codebase. The vulnerable code pattern (jsonpParameterNames field initialization with default values) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.2.10.RELEASE is not affected by CVE-2018-11040. The vulnerability concerned automatic JSONP support in MappingJackson2JsonView that enabled cross-domain requests through default parameter names \"jsonp\" and \"callback\". However, the entire JSONP feature was completely removed from Spring Framework in version 5.1.0.RC1 (June 2018) by upstream commit ac37b678a3. Since the target version 5.2.10.RELEASE is subsequent to 5.1.0, no JSONP code exists in the codebase. The vulnerable code pattern (jsonpParameterNames field initialization with default values) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:01:51.289649+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.2.10.RELEASE-tuxcare.3 is NOT affected by CVE-2018-1199. The vulnerability involves using specially encoded characters in URL path parameters to bypass Spring's path-based security constraints and access protected static resources. The fix (SPR-16616 series) was already present in the upstream Spring Framework 5.2.10.RELEASE before TuxCare onboarded it. The fix com...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.2.10.RELEASE-tuxcare.3 is NOT affected by CVE-2018-1199. The vulnerability involves using specially encoded characters in URL path parameters to bypass Spring's path-based security constraints and access protected static resources. The fix (SPR-16616 series) was already present in the upstream Spring Framework 5.2.10.RELEASE before TuxCare onboarded it. The fix com..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T09:10:31.335583+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target repository (Spring Framework 5.2.10.RELEASE) is NOT AFFECTED by CVE-2018-1257. The vulnerability fix was already present in the upstream release 5.2.10.RELEASE when TuxCare onboarded it. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac by Rossen Stoyanchev) allows disabling the selector header feature by setting selectorHeaderName to null, preventing the Spring EL expression ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Framework 5.2.10.RELEASE) is NOT AFFECTED by CVE-2018-1257. The vulnerability fix was already present in the upstream release 5.2.10.RELEASE when TuxCare onboarded it. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac by Rossen Stoyanchev) allows disabling the selector header feature by setting selectorHeaderName to null, preventing the Spring EL expression ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-1258 is NOT present in Spring Framework 5.2.10.RELEASE-tuxcare.3. The vulnerability was fixed in the upstream Spring Framework by commits aa11721ff0 and eaff2c28a7 (both from April 27, 2018), which corrected method resolution for JDK dynamic proxies to ensure security annotations are properly evaluated. These fixes were already included in the upstream 5.2.10.RELEASE (released October 2020) when TuxCare onboarded it. The target contains the patched code and does not exhibit the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is NOT present in Spring Framework 5.2.10.RELEASE-tuxcare.3. The vulnerability was fixed in the upstream Spring Framework by commits aa11721ff0 and eaff2c28a7 (both from April 27, 2018), which corrected method resolution for JDK dynamic proxies to ensure security annotations are properly evaluated. These fixes were already included in the upstream 5.2.10.RELEASE (released October 2020) when TuxCare onboarded it. The target contains the patched code and does not exhibit the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:35:35.339720+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.2.10.RELEASE. The upstream fix (adding isInvalidEncodedPath validation to reject URL-encoded directory traversal sequences like %2E%2E for ..) was already included in the 5.2.10.RELEASE when TuxCare onboarded it. Both servlet (spring-webmvc) and reactive (spring-webflux) resource handlers contain the fix and va...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.2.10.RELEASE. The upstream fix (adding isInvalidEncodedPath validation to reject URL-encoded directory traversal sequences like %2E%2E for ..) was already included in the 5.2.10.RELEASE when TuxCare onboarded it. Both servlet (spring-webmvc) and reactive (spring-webflux) resource handlers contain the fix and va..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-1272 is NOT present in Spring Framework 5.2.10.RELEASE. The vulnerability involved predictable multipart boundary generation using insecure Random, allowing attackers to inject additional multipart parts and potentially escalate privileges. The fix (replacing Random with SecureRandom in MimeTypeUtils) was already present in the upstream 5.2.10.RELEASE release that TuxCare onboarded. The target uses SecureRandom for all multipart boundary generation (MimeTypeUtils.java:382), making boundaries cryptographically unpredictable. Commit ab2410c754 by upstream developer rstoyanchev@pivotal.io shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in Spring Framework 5.2.10.RELEASE. The vulnerability involved predictable multipart boundary generation using insecure Random, allowing attackers to inject additional multipart parts and potentially escalate privileges. The fix (replacing Random with SecureRandom in MimeTypeUtils) was already present in the upstream 5.2.10.RELEASE release that TuxCare onboarded. The target uses SecureRandom for all multipart boundary generation (MimeTypeUtils.java:382), making boundaries cryptographically unpredictable. Commit ab2410c754 by upstream developer rstoyanchev@pivotal.io shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 does not affect this version. The vulnerability involves DoS via malicious HTTP Range headers with excessive range counts or overlapping ranges. The upstream Spring Framework 5.2.10.RELEASE (released October 2020) already contained the fix (MAX_RANGES=100 limit and overlap validation) when TuxCare onboarded it. Both defense mechanisms are present: (1) parseRanges() enforces maximum 100 ranges at HttpRange.java:136-138, and (2) toResourceRegions() validates sum of ranges < resource length at lines 185-195. Fix was authored by rstoyanchev@pivotal.io in commit 423aa28ed5, which predates the TuxCare onboarding commit f5348deccf.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 does not affect this version. The vulnerability involves DoS via malicious HTTP Range headers with excessive range counts or overlapping ranges. The upstream Spring Framework 5.2.10.RELEASE (released October 2020) already contained the fix (MAX_RANGES=100 limit and overlap validation) when TuxCare onboarded it. Both defense mechanisms are present: (1) parseRanges() enforces maximum 100 ranges at HttpRange.java:136-138, and (2) toResourceRegions() validates sum of ranges < resource length at lines 185-195. Fix was authored by rstoyanchev@pivotal.io in commit 423aa28ed5, which predates the TuxCare onboarding commit f5348deccf.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The relevant fixes replace `this.requestURI.matches(request.getRequestURI())` with `equals`, preventing a client URI from being interpreted as a regular expression (03 patch:30, 04 patch:30). In HEAD, `getMatchableHandlerMapping` wraps the request, loops through handler mappings, and returns the matching mapping directly, without consulting a cached URI (HandlerMappingIntrospector.java:124). Its CORS lookup also invokes mappings directly; the class has neither `CachedResult` nor the vulnerable URI comparison, so the CVE mechanism is absent rather than partially fixed (HandlerMappingIntrospector.java:142). The forwarded-header filter does lack the exception handler, and malformed forwarded ports can raise an exception, but those facts concern the separate HTTP-400 hardening changes (ForwardedHeaderFilter.java:134, UriComponentsBuilder.java:783, 01 patch:61).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The relevant fixes replace `this.requestURI.matches(request.getRequestURI())` with `equals`, preventing a client URI from being interpreted as a regular expression (03 patch:30, 04 patch:30). In HEAD, `getMatchableHandlerMapping` wraps the request, loops through handler mappings, and returns the matching mapping directly, without consulting a cached URI (HandlerMappingIntrospector.java:124). Its CORS lookup also invokes mappings directly; the class has neither `CachedResult` nor the vulnerable URI comparison, so the CVE mechanism is absent rather than partially fixed (HandlerMappingIntrospector.java:142). The forwarded-header filter does lack the exception handler, and malformed forwarded ports can raise an exception, but those facts concern the separate HTTP-400 hardening changes (ForwardedHeaderFilter.java:134, UriComponentsBuilder.java:783, 01 patch:61)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T15:06:43.748537+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.2.10.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.2.10.RELEASE-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.10.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T13:05:00.158209+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.2.10.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.2.10.RELEASE-tuxcare.3."
    }
  ]
}