{
  "@id": "urn:uuid:58935adb-4e52-481a-a2b0-34e5600e1aae",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:25:00.091559+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.25.RELEASE is not affected by CVE-2009-1190. The vulnerability explicitly requires JDK before 1.6 to exploit algorithmic complexity in Pattern.compile, but Spring 5.2.25 requires Java 8+ (sourceCompatibility=1.8). The affected Spring versions were 1.1.0-2.5.6 and 3.0.0.M1-M2; version 5.2.25 is far beyond this range. Modern JDKs (1.6+) have addressed the regex performance is...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.25.RELEASE is not affected by CVE-2009-1190. The vulnerability explicitly requires JDK before 1.6 to exploit algorithmic complexity in Pattern.compile, but Spring 5.2.25 requires Java 8+ (sourceCompatibility=1.8). The affected Spring versions were 1.1.0-2.5.6 and 3.0.0.M1-M2; version 5.2.25 is far beyond this range. Modern JDKs (1.6+) have addressed the regex performance is..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:50.837478+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.25.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.25.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5. The target version 5.2.25.RELEASE already contains the upstream fix (commit 7d8aa05c40, July 2011) that added the `acceptProxyClasses` configuration mechanism to reject malicious proxy deserialization. The defense code is present in ConfigurableObjectInputStream.resolveProxyClass() but defaults to accepting proxies (acceptProxyClasses=true) fo...",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5. The target version 5.2.25.RELEASE already contains the upstream fix (commit 7d8aa05c40, July 2011) that added the `acceptProxyClasses` configuration mechanism to reject malicious proxy deserialization. The defense code is present in ConfigurableObjectInputStream.resolveProxyClass() but defaults to accepting proxies (acceptProxyClasses=true) fo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 5.2.25.RELEASE. The vulnerability (directory traversal via crafted URLs with colons in path segments like `/a/:b/../../file`) was fixed in the upstream Spring Framework in May 2014 (commit 8ee4651038 by Rossen Stoyanchev). This fix was already included in the upstream 5.2.25.RELEASE before TuxCare onboarded it. The vulnerable code pattern does no...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 5.2.25.RELEASE. The vulnerability (directory traversal via crafted URLs with colons in path segments like `/a/:b/../../file`) was fixed in the upstream Spring Framework in May 2014 (commit 8ee4651038 by Rossen Stoyanchev). This fix was already included in the upstream 5.2.25.RELEASE before TuxCare onboarded it. The vulnerable code pattern does no..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (SecureRandom for initial seed, then non-cryptographic Random). The vulnerability was fixed in upstream Spring Framework 4.1.5 (commit 52b8f34468, January 2015) by switching to JdkIdGenerator which uses UUID.randomUUID() for cryptographically secure...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (SecureRandom for initial seed, then non-cryptographic Random). The vulnerability was fixed in upstream Spring Framework 4.1.5 (commit 52b8f34468, January 2015) by switching to JdkIdGenerator which uses UUID.randomUUID() for cryptographically secure..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in this target. The upstream Spring Framework fix (commit 2bd1daa75e from 2015-10-04) was already included in Spring Framework 5.2.0, released in 2019. Version 5.2.25.RELEASE naturally contains this fix. The RFD protection code (addContentDispositionHeader method in AbstractMessageConverterMethodProcessor) is present and active, adding Content-Disposition headers to prevent browsers from downloading responses with dangerous file extensions. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in this target. The upstream Spring Framework fix (commit 2bd1daa75e from 2015-10-04) was already included in Spring Framework 5.2.0, released in 2019. Version 5.2.25.RELEASE naturally contains this fix. The RFD protection code (addContentDispositionHeader method in AbstractMessageConverterMethodProcessor) is present and active, adding Content-Disposition headers to prevent browsers from downloading responses with dangerous file extensions. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security and Spring MVC that could lead to authorization bypass. The vulnerability is NOT present in the target (Spring Framework 5.2.25.RELEASE at commit e436757eb7). The upstream fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5, authored by rstoyanchev@pivotal.io on 2016-06-27) introduced the HandlerMappingIntrospector API, which exposes Spring MVC's pattern matching logic to external authorization systems. This fix was already included in the upstream Spring Framework 5.2.25.RELEASE before TuxCare onboarded it on 2026-09-11 (commit bc2c13ac). All defense components are present and functional: HandlerMappingIntrospector, MatchableHandlerMapping interface, and implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security and Spring MVC that could lead to authorization bypass. The vulnerability is NOT present in the target (Spring Framework 5.2.25.RELEASE at commit e436757eb7). The upstream fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5, authored by rstoyanchev@pivotal.io on 2016-06-27) introduced the HandlerMappingIntrospector API, which exposes Spring MVC's pattern matching logic to external authorization systems. This fix was already included in the upstream Spring Framework 5.2.25.RELEASE before TuxCare onboarded it on 2026-09-11 (commit bc2c13ac). All defense components are present and functional: HandlerMappingIntrospector, MatchableHandlerMapping interface, and implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework's JSONP support via AbstractJsonpResponseBodyAdvice and MappingJackson2JsonView, allowing cross-domain requests through \"jsonp\" and \"callback\" query parameters. The target version 5.2.25.RELEASE is NOT affected because upstream vendor completely removed JSONP support in commit ac37b678a3 (June 2018) by Sebastien Deleuze, which was already included in the 5.2.25.RELEASE that TuxCare onboarded. The vulnerable classes AbstractJsonpResponseBodyAdvice.java has been deleted, and MappingJackson2JsonView.java has all JSONP-related code removed (jsonpParameterNames field, setJsonpParameterNames method, getJsonpParameterValue method, JSONP parameter handling logic). No JSONP functionality exists in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework's JSONP support via AbstractJsonpResponseBodyAdvice and MappingJackson2JsonView, allowing cross-domain requests through \"jsonp\" and \"callback\" query parameters. The target version 5.2.25.RELEASE is NOT affected because upstream vendor completely removed JSONP support in commit ac37b678a3 (June 2018) by Sebastien Deleuze, which was already included in the 5.2.25.RELEASE that TuxCare onboarded. The vulnerable classes AbstractJsonpResponseBodyAdvice.java has been deleted, and MappingJackson2JsonView.java has all JSONP-related code removed (jsonpParameterNames field, setJsonpParameterNames method, getJsonpParameterValue method, JSONP parameter handling logic). No JSONP functionality exists in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework versions before 4.3.14 (4.3.x) and before 5.0.3 (5.0.x). The target version 5.2.25.RELEASE (released July 2023) is not affected because the fix was already present in the upstream release when TuxCare onboarded it. The vulnerability allowed attackers to bypass security constraints by using URL path parameters with special encodings. The fix ensures semicol...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework versions before 4.3.14 (4.3.x) and before 5.0.3 (5.0.x). The target version 5.2.25.RELEASE (released July 2023) is not affected because the fix was already present in the upstream release when TuxCare onboarded it. The vulnerability allowed attackers to bypass security constraints by using URL path parameters with special encodings. The fix ensures semicol..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 (STOMP WebSocket regex DoS) is not present in Spring Framework 5.2.25.RELEASE. The fix allowing administrators to disable the vulnerable selector header feature by setting selectorHeaderName to null was authored by upstream Spring Framework (rstoyanchev@pivotal.io) and shipped in the upstream 5.2.25.RELEASE before TuxCare onboarded it. All three affected files (DefaultSubscription...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 (STOMP WebSocket regex DoS) is not present in Spring Framework 5.2.25.RELEASE. The fix allowing administrators to disable the vulnerable selector header feature by setting selectorHeaderName to null was authored by upstream Spring Framework (rstoyanchev@pivotal.io) and shipped in the upstream 5.2.25.RELEASE before TuxCare onboarded it. All three affected files (DefaultSubscription..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. CVE-2018-1258 is an authorization bypass vulnerability in Spring Framework 5.0.5 that allows attackers to bypass method-level security annotations. The vulnerability was caused by AopUtils.getMostSpecificMethod() incorrectly skipping method resolution for JDK dynamic proxies via a `!Proxy.isProxyClass(targetClass)` check, preventing security annotations from being evaluated. The target repository (Spring Framework 5.2.25.RELEASE-tuxcare.4) is NOT affected because the upstream fix by Juergen Hoeller (commits aa11721ff0 and eaff2c28a7, April 27, 2018) was already present in the 5.2.25.RELEASE version when TuxCare onboarded it. The vulnerable code pattern is absent from all relevant code paths: AopUtils, CacheAspectSupport, ApplicationListenerMethodAdapter, and AnnotationMethodMatcher all contain the fixed implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is an authorization bypass vulnerability in Spring Framework 5.0.5 that allows attackers to bypass method-level security annotations. The vulnerability was caused by AopUtils.getMostSpecificMethod() incorrectly skipping method resolution for JDK dynamic proxies via a `!Proxy.isProxyClass(targetClass)` check, preventing security annotations from being evaluated. The target repository (Spring Framework 5.2.25.RELEASE-tuxcare.4) is NOT affected because the upstream fix by Juergen Hoeller (commits aa11721ff0 and eaff2c28a7, April 27, 2018) was already present in the 5.2.25.RELEASE version when TuxCare onboarded it. The vulnerable code pattern is absent from all relevant code paths: AopUtils, CacheAspectSupport, ApplicationListenerMethodAdapter, and AnnotationMethodMatcher all contain the fixed implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 5.0 < 5.0.5 and 4.3 < 4.3.15 due to missing validation of backslash-based directory traversal sequences (..\\\\) on Windows. The target version 5.2.25.RELEASE already contains the upstream fix from commit f59ea610dfcf55cd0b42f6dd76a9b3dab0218aaa (authored by jhoeller@pivotal.io in March 2018). The fix was shipped in the upstream release before TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 5.0 < 5.0.5 and 4.3 < 4.3.15 due to missing validation of backslash-based directory traversal sequences (..\\\\) on Windows. The target version 5.2.25.RELEASE already contains the upstream fix from commit f59ea610dfcf55cd0b42f6dd76a9b3dab0218aaa (authored by jhoeller@pivotal.io in March 2018). The fix was shipped in the upstream release before TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. Target Spring Framework 5.2.25.RELEASE is not affected by CVE-2018-1272. The vulnerability (predictable multipart boundary generation using weak Random) was fixed by upstream Spring in June 2018 (commit 847202c8f8), years before the 5.2.25.RELEASE (April 2021) was created. The target uses SecureRandom for all multipart boundary generation via lazy initialization in MimeTypeUtils.initRandom().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Target Spring Framework 5.2.25.RELEASE is not affected by CVE-2018-1272. The vulnerability (predictable multipart boundary generation using weak Random) was fixed by upstream Spring in June 2018 (commit 847202c8f8), years before the 5.2.25.RELEASE (April 2021) was created. The target uses SecureRandom for all multipart boundary generation via lazy initialization in MimeTypeUtils.initRandom().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. The target Spring Framework 5.2.25.RELEASE is not affected by CVE-2018-15756. The vulnerability, which allowed DoS attacks via malicious HTTP Range headers with excessive ranges or overlapping ranges, was fixed by upstream Spring Framework in October 2018 (commit 423aa28ed5 by rstoyanchev@pivotal.io). This fix was already present in the upstream 5.2.25.RELEASE when TuxCare onboarded it. The target code contains both required protections: MAX_RANGES=100 limit and validation that sum of all ranges is less than resource length.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 5.2.25.RELEASE is not affected by CVE-2018-15756. The vulnerability, which allowed DoS attacks via malicious HTTP Range headers with excessive ranges or overlapping ranges, was fixed by upstream Spring Framework in October 2018 (commit 423aa28ed5 by rstoyanchev@pivotal.io). This fix was already present in the upstream 5.2.25.RELEASE when TuxCare onboarded it. The target code contains both required protections: MAX_RANGES=100 limit and validation that sum of all ranges is less than resource length.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 is NOT present in Spring Framework 5.2.25.RELEASE. The vulnerability is a log injection issue where attackers can insert fake log entries by injecting newline or control characters. The complete fix was shipped in upstream Spring Framework v5.2.19.RELEASE (December 2021) and is present in v5.2.25.RELEASE (July 2023) that TuxCare onboarded. The fix consists of two parts: (1) LogFo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 is NOT present in Spring Framework 5.2.25.RELEASE. The vulnerability is a log injection issue where attackers can insert fake log entries by injecting newline or control characters. The complete fix was shipped in upstream Spring Framework v5.2.19.RELEASE (December 2021) and is present in v5.2.25.RELEASE (July 2023) that TuxCare onboarded. The fix consists of two parts: (1) LogFo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.2.25.RELEASE is NOT vulnerable to CVE-2021-22096 (log injection). The vulnerability pattern is not present because the upstream vendor fix was already included when 5.2.25.RELEASE was released. The fix sanitizes newlines and control characters in logged values through LogFormatUtils.formatValue(), preventing attackers from injecting fabricated log entries. Fix comm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.2.25.RELEASE is NOT vulnerable to CVE-2021-22096 (log injection). The vulnerability pattern is not present because the upstream vendor fix was already included when 5.2.25.RELEASE was released. The fix sanitizes newlines and control characters in logged values through LogFormatUtils.formatValue(), preventing attackers from injecting fabricated log entries. Fix comm..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-10T04:25:00.091559+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124, handler lookup directly iterates handler mappings; the class ends at line 213 without CachedResult, a cache-filter API, or a request-URI regular-expression comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124, handler lookup directly iterates handler mappings; the class ends at line 213 without CachedResult, a cache-filter API, or a request-URI regular-expression comparison."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:29:35.111511+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.25.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T18:30:00.042151+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.2.25.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}