{
  "@id": "urn:uuid:10df8954-f39f-418d-a491-576e2c34fe22",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:23:00.432361+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T11:56:07.700614+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is a JDK vulnerability, not a Spring Framework vulnerability. The CVE explicitly states the root cause is \"Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6\". Spring Framework 5.2.9.RELEASE requires Java 8 (JDK 1.8) or higher (sourceCompatibility = 1.8), which includes the JDK 1.6+ fix for the algorithmi...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is a JDK vulnerability, not a Spring Framework vulnerability. The CVE explicitly states the root cause is \"Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6\". Spring Framework 5.2.9.RELEASE requires Java 8 (JDK 1.8) or higher (sourceCompatibility = 1.8), which includes the JDK 1.6+ fix for the algorithmi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:32:38.990328+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.9.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.9.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:42:00.129119+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target repository Spring Framework 5.2.9.RELEASE-tuxcare.2 is NOT AFFECTED by CVE-2011-2894. The vulnerability (unrestricted deserialization of Java proxy classes enabling arbitrary code execution) was fixed by upstream Spring Framework in version 3.0.6 (July 2011). The fix added an `acceptProxyClasses` flag to ConfigurableObjectInputStream, RemoteInvocationSerializingExporter, and Codebase...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target repository Spring Framework 5.2.9.RELEASE-tuxcare.2 is NOT AFFECTED by CVE-2011-2894. The vulnerability (unrestricted deserialization of Java proxy classes enabling arbitrary code execution) was fixed by upstream Spring Framework in version 3.0.6 (July 2011). The fix added an `acceptProxyClasses` flag to ConfigurableObjectInputStream, RemoteInvocationSerializingExporter, and Codebase..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.2.9.RELEASE is not affected by CVE-2014-3578. The directory traversal vulnerability in StringUtils.cleanPath() was fixed in upstream commit 8ee4651038 (2014-05-15) by Rossen Stoyanchev, approximately 6 years before the 5.2.9.RELEASE (2020-09-15). The fix prevents path traversal by discarding prefix markers containing forward slashes, ensuring proper resolution of \"...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.2.9.RELEASE is not affected by CVE-2014-3578. The directory traversal vulnerability in StringUtils.cleanPath() was fixed in upstream commit 8ee4651038 (2014-05-15) by Rossen Stoyanchev, approximately 6 years before the 5.2.9.RELEASE (2020-09-15). The fix prevents path traversal by discarding prefix markers containing forward slashes, ensuring proper resolution of \"..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:10:07.033142+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5, where the SockJS client used AlternativeJdkIdGenerator (predictable java.util.Random) for session ID generation. The target version 5.2.9.RELEASE uses JdkIdGenerator (cryptographically secure UUID.randomUUID()), which was introduced in the upstream fix commit 52b8f34468 (SPR-12658) in January 2015. This fix shipped in upstream v4.1.5.R...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5, where the SockJS client used AlternativeJdkIdGenerator (predictable java.util.Random) for session ID generation. The target version 5.2.9.RELEASE uses JdkIdGenerator (cryptographically secure UUID.randomUUID()), which was introduced in the upstream fix commit 52b8f34468 (SPR-12658) in January 2015. This fix shipped in upstream v4.1.5.R..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:00:16.038874+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is not present in Spring Framework 5.2.9.RELEASE. The upstream fix commit 2bd1daa75e \"Protect against RFD exploits\" shipped in the original 5.2.9.RELEASE before TuxCare onboarded it. The fix adds Content-Disposition headers with safe filenames when request URLs contain dangerous file extensions, preventing browsers from downloading responses with attacker-controlled extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is not present in Spring Framework 5.2.9.RELEASE. The upstream fix commit 2bd1daa75e \"Protect against RFD exploits\" shipped in the original 5.2.9.RELEASE before TuxCare onboarded it. The fix adds Content-Disposition headers with safe filenames when request URLs contain dangerous file extensions, preventing browsers from downloading responses with attacker-controlled extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.2.9.RELEASE. The vulnerability concerns pattern matching discrepancies between Spring Security's authorization layer and Spring MVC's request routing that could allow authorization bypass. The fix (MatchableHandlerMapping interface, HandlerMappingIntrospector class, and match() method implementations) was introduced by upstream Spring Framework in version 4.3.1.RELEASE (April 2016, commit a30ab30e4e by Rossen Stoyanchev) and is present in all subsequent versions including 5.2.9.RELEASE. The fix provides a unified API allowing Spring Security to use the exact same pattern matching logic as Spring MVC's routing, eliminating the discrepancy. This is an upstream fix that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.2.9.RELEASE. The vulnerability concerns pattern matching discrepancies between Spring Security's authorization layer and Spring MVC's request routing that could allow authorization bypass. The fix (MatchableHandlerMapping interface, HandlerMappingIntrospector class, and match() method implementations) was introduced by upstream Spring Framework in version 4.3.1.RELEASE (April 2016, commit a30ab30e4e by Rossen Stoyanchev) and is present in all subsequent versions including 5.2.9.RELEASE. The fix provides a unified API allowing Spring Security to use the exact same pattern matching logic as Spring MVC's routing, eliminating the discrepancy. This is an upstream fix that shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:53:55.157124+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.2.9.RELEASE is not affected by CVE-2018-11040. The vulnerable JSONP functionality (automatic JSONP wrapping via default parameter names \"jsonp\" and \"callback\" in MappingJackson2JsonView) was completely removed by the upstream vendor in commit ac37b678a3 (2018-06-07), over two years before the 5.2.9.RELEASE was published (2020-09-15). The removal was already present in the upstream release when TuxCare onboarded it for ELS maintenance.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.2.9.RELEASE is not affected by CVE-2018-11040. The vulnerable JSONP functionality (automatic JSONP wrapping via default parameter names \"jsonp\" and \"callback\" in MappingJackson2JsonView) was completely removed by the upstream vendor in commit ac37b678a3 (2018-06-07), over two years before the 5.2.9.RELEASE was published (2020-09-15). The removal was already present in the upstream release when TuxCare onboarded it for ELS maintenance.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:01:33.678856+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.9.RELEASE already contains the upstream fix for CVE-2018-1199. The vulnerability affects versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The fix was introduced by upstream developers in March 2018 (commits 0e28bee0f1 and 91b803a231) and was already present in the 5.2.9.RELEASE version when TuxCare onboarded it in September 2026. All three affected components (ResourceH...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.9.RELEASE already contains the upstream fix for CVE-2018-1199. The vulnerability affects versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The fix was introduced by upstream developers in March 2018 (commits 0e28bee0f1 and 91b803a231) and was already present in the 5.2.9.RELEASE version when TuxCare onboarded it in September 2026. All three affected components (ResourceH..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T11:56:07.700614+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.2.9.RELEASE is not affected by CVE-2018-1257. The fix for this regex DoS vulnerability was already present in the upstream release when TuxCare onboarded it. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac) allows disabling selector expression parsing by accepting null for the selector header name, with guard checks preventing any expression parsing when d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.2.9.RELEASE is not affected by CVE-2018-1257. The fix for this regex DoS vulnerability was already present in the upstream release when TuxCare onboarded it. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac) allows disabling selector expression parsing by accepting null for the selector header name, with guard checks preventing any expression parsing when d..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 is NOT present in Spring Framework 5.2.9.RELEASE. The vulnerability was fixed in upstream Spring Framework on April 27, 2018 (commits aa11721ff0f and eaff2c28a7). These fixes were already included in Spring Framework 5.2.9.RELEASE when TuxCare onboarded it in September 2026. All three key components of the fix are present in the target: (1) AopUtils.getMostSpecificMethod properly resolves proxy classes, (2) CacheAspectSupport includes targetMethod field and proper method resolution, (3) AnnotationMethodMatcher includes proxy class early-return check. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is NOT present in Spring Framework 5.2.9.RELEASE. The vulnerability was fixed in upstream Spring Framework on April 27, 2018 (commits aa11721ff0f and eaff2c28a7). These fixes were already included in Spring Framework 5.2.9.RELEASE when TuxCare onboarded it in September 2026. All three key components of the fix are present in the target: (1) AopUtils.getMostSpecificMethod properly resolves proxy classes, (2) CacheAspectSupport includes targetMethod field and proper method resolution, (3) AnnotationMethodMatcher includes proxy class early-return check. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T11:56:07.700614+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 5.2.9.RELEASE. The vulnerability (directory traversal via backslash characters on Windows) was fixed in upstream Spring Framework 5.0.5 (March 2018) by commit 0e28bee0f. The fix normalizes backslashes to forward slashes in resource paths before validation. Spring Framework 5.2.9.RELEASE (August 2020) was released long after the fix and ships with...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 5.2.9.RELEASE. The vulnerability (directory traversal via backslash characters on Windows) was fixed in upstream Spring Framework 5.0.5 (March 2018) by commit 0e28bee0f. The fix normalizes backslashes to forward slashes in resource paths before validation. Spring Framework 5.2.9.RELEASE (August 2020) was released long after the fix and ships with..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 is NOT present in the target repository at version 5.2.9.RELEASE (commit c6bf5b2245). The vulnerability involved predictable multipart boundary generation using weak Random instead of SecureRandom, allowing attackers to inject additional multipart parts. The fix (replacing Random with SecureRandom in MimeTypeUtils.generateMultipartBoundary()) was authored by upstream Spring Framework developer Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit ab2410c754 and shipped with the upstream v5.2.9.RELEASE tag. TuxCare's onboarding commit (097b1afb26) imported this already-fixed upstream version. All multipart boundary generation in the framework delegates to the fixed MimeTypeUtils.generateMultipartBoundary() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in the target repository at version 5.2.9.RELEASE (commit c6bf5b2245). The vulnerability involved predictable multipart boundary generation using weak Random instead of SecureRandom, allowing attackers to inject additional multipart parts. The fix (replacing Random with SecureRandom in MimeTypeUtils.generateMultipartBoundary()) was authored by upstream Spring Framework developer Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit ab2410c754 and shipped with the upstream v5.2.9.RELEASE tag. TuxCare's onboarding commit (097b1afb26) imported this already-fixed upstream version. All multipart boundary generation in the framework delegates to the fixed MimeTypeUtils.generateMultipartBoundary() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:34:53.925887+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. Target is not affected by CVE-2018-15756. The vulnerability (DoS via malicious HTTP Range headers with excessive range counts or overlapping ranges) was fixed in upstream Spring Framework 5.2.0.M1 via commit 423aa28e by Rossen Stoyanchev. The fix adds two validations: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges, (2) sum validation rejecting overlapping ranges whose total byte count equals or exceeds resource length. Since the target is Spring Framework 5.2.9.RELEASE, the fix was already present in the upstream release that TuxCare onboarded. The fix code is present at HttpRange.java lines 48, 136-138, and 185-195, and is actively used in production paths including ResourceHttpRequestHandler for static resource serving.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Target is not affected by CVE-2018-15756. The vulnerability (DoS via malicious HTTP Range headers with excessive range counts or overlapping ranges) was fixed in upstream Spring Framework 5.2.0.M1 via commit 423aa28e by Rossen Stoyanchev. The fix adds two validations: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges, (2) sum validation rejecting overlapping ranges whose total byte count equals or exceeds resource length. Since the target is Spring Framework 5.2.9.RELEASE, the fix was already present in the upstream release that TuxCare onboarded. The fix code is present at HttpRange.java lines 48, 136-138, and 185-195, and is actively used in production paths including ResourceHttpRequestHandler for static resource serving.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T11:56:07.700614+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T11:56:07.700614+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:23:00.432361+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the request-URI regular-expression comparison that causes the vulnerability. The matching entry point queries handler mappings directly at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124; the class has no CachedResult, cache API, or request-URI regex comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the request-URI regular-expression comparison that causes the vulnerability. The matching entry point queries handler mappings directly at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124; the class has no CachedResult, cache API, or request-URI regex comparison."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T16:05:00.073168+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.9.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.9.RELEASE-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.9.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T11:56:31.850641+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.2.9.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}