{
  "@id": "urn:uuid:ed31ac56-551f-4693-a0e9-bdcf81f1c3a4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:40:04.386984+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:51:09.223913+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in regex pattern matching that causes CPU exhaustion via catastrophic backtracking. The target version (5.2.8.RELEASE) is not affected because the upstream Spring Framework already fixed this vulnerability before this release. The fix (commit d4a55a257b by jhoeller@pivotal.io, 2018-04-17) introduced PATTERN_ACCESS_THRESHOLD protect...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in regex pattern matching that causes CPU exhaustion via catastrophic backtracking. The target version (5.2.8.RELEASE) is not affected because the upstream Spring Framework already fixed this vulnerability before this release. The fix (commit d4a55a257b by jhoeller@pivotal.io, 2018-04-17) introduced PATTERN_ACCESS_THRESHOLD protect..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:04.386984+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.8.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.8.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:51:00.166719+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of proxy classes. The target (Spring Framework 5.2.8.RELEASE) contains the upstream vendor fix (commit 7d8aa05c407 by jhoeller@vmware.com, July 2011) that adds an acceptProxyClasses defense mechanism. The fix was included in the upstream 5.2.8.RELEASE before TuxCare onboarded it. The defense mechanism exists in Config...",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of proxy classes. The target (Spring Framework 5.2.8.RELEASE) contains the upstream vendor fix (commit 7d8aa05c407 by jhoeller@vmware.com, July 2011) that adds an acceptProxyClasses defense mechanism. The fix was included in the upstream 5.2.8.RELEASE before TuxCare onboarded it. The defense mechanism exists in Config..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.2.8.RELEASE. The fix was already included in the upstream release. The vulnerability allowed attackers to read arbitrary files by crafting URLs with colons (e.g., /a/:b/../../file) that bypassed path normalization. The fix (commit 8ee46510385) adds validation in StringUtils.cleanPath() to check if a prefix cont...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.2.8.RELEASE. The fix was already included in the upstream release. The vulnerability allowed attackers to read arbitrary files by crafting URLs with colons (e.g., /a/:b/../../file) that bypassed path normalization. The fix (commit 8ee46510385) adds validation in StringUtils.cleanPath() to check if a prefix cont..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:19:36.318385+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client generated predictable session IDs. The target repository (Spring Framework 5.2.8.RELEASE) is not affected because the vulnerability was fixed in upstream version 4.1.5 (released January 2015) and that fix is present in version 5.2.8.RELEASE. The vulnerable code used AlternativeJdkIdGenerator (which relies on predi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client generated predictable session IDs. The target repository (Spring Framework 5.2.8.RELEASE) is not affected because the vulnerability was fixed in upstream version 4.1.5 (released January 2015) and that fix is present in version 5.2.8.RELEASE. The vulnerable code used AlternativeJdkIdGenerator (which relies on predi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:13.759745+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.2.8.RELEASE is not affected by CVE-2015-5211 (Reflected File Download). The RFD defense mechanism was already present in the upstream Spring Framework 5.2.8.RELEASE when TuxCare onboarded it. The fix (commit 2bd1daa75e) was authored by upstream developers (Pivotal/VMware) and shipped in the original 5.2.8.RELEASE. The defense adds Content-Disposition headers with safe filenames when request URLs contain non-whitelisted file extensions, preventing browsers from downloading responses as executable files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "The target Spring Framework 5.2.8.RELEASE is not affected by CVE-2015-5211 (Reflected File Download). The RFD defense mechanism was already present in the upstream Spring Framework 5.2.8.RELEASE when TuxCare onboarded it. The fix (commit 2bd1daa75e) was authored by upstream developers (Pivotal/VMware) and shipped in the original 5.2.8.RELEASE. The defense adds Content-Disposition headers with safe filenames when request URLs contain non-whitelisted file extensions, preventing browsers from downloading responses as executable files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:59.012677+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. Target version 5.2.8.RELEASE is not affected by CVE-2016-5007. The vulnerability required absence of a shared pattern matching API between Spring Security and Spring MVC, allowing authorization bypass due to matching inconsistencies. The fix (HandlerMappingIntrospector and MatchableHandlerMapping interface) was introduced in upstream v4.3.1.RELEASE (April 2016) and shipped in all subsequent releases including 5.2.8.RELEASE (2020). The fix commit a30ab30e4e by upstream author rstoyanchev@pivotal.io is present at HEAD, with both AbstractUrlHandlerMapping and RequestMappingHandlerMapping implementing the MatchableHandlerMapping.match() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Target version 5.2.8.RELEASE is not affected by CVE-2016-5007. The vulnerability required absence of a shared pattern matching API between Spring Security and Spring MVC, allowing authorization bypass due to matching inconsistencies. The fix (HandlerMappingIntrospector and MatchableHandlerMapping interface) was introduced in upstream v4.3.1.RELEASE (April 2016) and shipped in all subsequent releases including 5.2.8.RELEASE (2020). The fix commit a30ab30e4e by upstream author rstoyanchev@pivotal.io is present at HEAD, with both AbstractUrlHandlerMapping and RequestMappingHandlerMapping implementing the MatchableHandlerMapping.match() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:00:11.067776+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.2.8.RELEASE is NOT affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed by upstream commit ac37b678a3 (June 7, 2018) before Spring Framework 5.2.8.RELEASE was released (June 2020). The CVE affects \"versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18\"; version 5.2.8 is much newer and shipped with the fix already applied. No JSONP-related code, classes, or fields exist in the current repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target Spring Framework 5.2.8.RELEASE is NOT affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed by upstream commit ac37b678a3 (June 7, 2018) before Spring Framework 5.2.8.RELEASE was released (June 2020). The CVE affects \"versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18\"; version 5.2.8 is much newer and shipped with the fix already applied. No JSONP-related code, classes, or fields exist in the current repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:12:00.497472+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2018-1199. The vulnerability affects versions 5.0.x before 5.0.3 and 4.3.x before 4.3.14. All fixes for path parameter bypass via encoded separators were shipped in the upstream v5.2.8.RELEASE before TuxCare onboarding. The code contains comprehensive defenses: path normalization (replacing backslashes with forward slashes, removing duplicat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2018-1199. The vulnerability affects versions 5.0.x before 5.0.3 and 4.3.x before 4.3.14. All fixes for path parameter bypass via encoded separators were shipped in the upstream v5.2.8.RELEASE before TuxCare onboarding. The code contains comprehensive defenses: path normalization (replacing backslashes with forward slashes, removing duplicat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 concerns a regex DoS vulnerability in Spring Framework's STOMP broker selector header parsing. The target version 5.2.8.RELEASE is NOT affected because the upstream fix (commit ff2228fdaf) was already included in the upstream release when TuxCare onboarded it. The fix adds a null-check to disable selector header parsing entirely when configured to null, preventing malicious Spring...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 concerns a regex DoS vulnerability in Spring Framework's STOMP broker selector header parsing. The target version 5.2.8.RELEASE is NOT affected because the upstream fix (commit ff2228fdaf) was already included in the upstream release when TuxCare onboarded it. The fix adds a null-check to disable selector header parsing entirely when configured to null, preventing malicious Spring..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 is not present in Spring Framework 5.2.8.RELEASE-tuxcare.2. The vulnerability affects incorrect method resolution for AOP proxies that causes Spring Security method-level authorization checks to be bypassed. The upstream fix commits (aa11721ff0 and eaff2c28a7, both by jhoeller@pivotal.io on 2018-04-27) were already included in the upstream 5.2.8.RELEASE when TuxCare onboarded it on commit f68bfc3c8a. All three defensive code changes are present in HEAD: (1) AopUtils.getMostSpecificMethod() correctly handles proxy classes without excluding them, (2) AnnotationMethodMatcher returns early for proxy classes, and (3) CacheAspectSupport properly resolves target methods with proxy handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is not present in Spring Framework 5.2.8.RELEASE-tuxcare.2. The vulnerability affects incorrect method resolution for AOP proxies that causes Spring Security method-level authorization checks to be bypassed. The upstream fix commits (aa11721ff0 and eaff2c28a7, both by jhoeller@pivotal.io on 2018-04-27) were already included in the upstream 5.2.8.RELEASE when TuxCare onboarded it on commit f68bfc3c8a. All three defensive code changes are present in HEAD: (1) AopUtils.getMostSpecificMethod() correctly handles proxy classes without excluding them, (2) AnnotationMethodMatcher returns early for proxy classes, and (3) CacheAspectSupport properly resolves target methods with proxy handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:03:00.088654+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version 5.2.8.RELEASE already contains the fix from upstream Spring Framework. The fix (commits 91b803a2310 and 98ad23bef8e by jhoeller@pivotal.io from March 2018) adds URL-decoding and validation to detect encoded directory traversal sequences (../ and ..\\\\) in static resource paths. These fixes shipp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version 5.2.8.RELEASE already contains the fix from upstream Spring Framework. The fix (commits 91b803a2310 and 98ad23bef8e by jhoeller@pivotal.io from March 2018) adds URL-decoding and validation to detect encoded directory traversal sequences (../ and ..\\\\) in static resource paths. These fixes shipp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.2.8.RELEASE is NOT affected by CVE-2018-1272. The vulnerability involved predictable multipart boundaries generated using weak Random(), allowing attackers to inject crafted boundaries and cause multipart parsers to interpret attacker-controlled content as separate parts (potentially leading to privilege escalation). The target uses SecureRandom with lazy initialization (commit 847202c8 by jhoeller@pivotal.io, June 2018), which was already included in the upstream 5.2.8.RELEASE (July 2020) before TuxCare onboarded it. All multipart boundary generation paths delegate to MimeTypeUtils.generateMultipartBoundary(), which uses the secure implementation. The vulnerable pattern (weak Random) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "The target Spring Framework 5.2.8.RELEASE is NOT affected by CVE-2018-1272. The vulnerability involved predictable multipart boundaries generated using weak Random(), allowing attackers to inject crafted boundaries and cause multipart parsers to interpret attacker-controlled content as separate parts (potentially leading to privilege escalation). The target uses SecureRandom with lazy initialization (commit 847202c8 by jhoeller@pivotal.io, June 2018), which was already included in the upstream 5.2.8.RELEASE (July 2020) before TuxCare onboarded it. All multipart boundary generation paths delegate to MimeTypeUtils.generateMultipartBoundary(), which uses the secure implementation. The vulnerable pattern (weak Random) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:44:14.640121+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 DoS vulnerability via malicious HTTP Range headers is NOT present in this target. The upstream Spring Framework fix (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e) was already included in version 5.2.8.RELEASE before TuxCare onboarded it. Both required defenses are present: (1) MAX_RANGES limit of 100 in parseRanges() at line 136-138, and (2) sum validation in toResourceRegions() at lines 191-194 preventing overlapping ranges from exceeding resource length. The vulnerable pattern described in the CVE (unlimited range count and no overlap validation) does not exist in this code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 DoS vulnerability via malicious HTTP Range headers is NOT present in this target. The upstream Spring Framework fix (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e) was already included in version 5.2.8.RELEASE before TuxCare onboarded it. Both required defenses are present: (1) MAX_RANGES limit of 100 in parseRanges() at line 136-138, and (2) sum validation in toResourceRegions() at lines 191-194 preventing overlapping ranges from exceeding resource length. The vulnerable pattern described in the CVE (unlimited range count and no overlap validation) does not exist in this code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:51:41.648794+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:51:41.648794+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T13:59:20.482368+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.8.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.8.RELEASE-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:00:22.866405+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.8.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.8.RELEASE-tuxcare.3."
    }
  ]
}