{
  "@id": "urn:uuid:1e7a8c46-3766-43a3-b01d-b405d342a1f6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 56,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:21:52.088444+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T11:54:00.134869+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile() in JDK versions before 1.6. While Spring Framework 5.3.21 contains PatternEditor.setAsText() that calls Pattern.compile() without validation (the same code pattern mentioned in the CVE), the target is not affected because it requires JDK 8 or later to run. The underlying JDK vulnerability was fi...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile() in JDK versions before 1.6. While Spring Framework 5.3.21 contains PatternEditor.setAsText() that calls Pattern.compile() without validation (the same code pattern mentioned in the CVE), the target is not affected because it requires JDK 8 or later to run. The underlying JDK vulnerability was fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:27:46.722408+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.21 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.21 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:33:20.113674+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe proxy class deserialization. The target (Spring Framework 5.3.21-tuxcare.6) contains the upstream vendor fix (commit 7d8aa05c407 by jhoeller@vmware.com, July 2011) that adds an `acceptProxyClasses` configuration flag to block proxy deserialization. This fix shipped in Spring 3.2.0.M1 and all later versions, including 5.3.21. The defe...",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe proxy class deserialization. The target (Spring Framework 5.3.21-tuxcare.6) contains the upstream vendor fix (commit 7d8aa05c407 by jhoeller@vmware.com, July 2011) that adds an `acceptProxyClasses` configuration flag to block proxy deserialization. This fix shipped in Spring 3.2.0.M1 and all later versions, including 5.3.21. The defe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.21 is NOT affected by CVE-2014-3578. The vulnerability was a directory traversal issue in StringUtils.cleanPath() that allowed attackers to read arbitrary files via crafted URLs containing colons with forward slashes in the prefix (e.g., /a/:b/../../secret.txt). The fix validates that any extracted prefix does not contain forward slashes, preventing path traversa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.21 is NOT affected by CVE-2014-3578. The vulnerability was a directory traversal issue in StringUtils.cleanPath() that allowed attackers to read arbitrary files via crafted URLs containing colons with forward slashes in the prefix (e.g., /a/:b/../../secret.txt). The fix validates that any extracted prefix does not contain forward slashes, preventing path traversa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:04:00.051306+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client used AlternativeJdkIdGenerator for session ID generation. This class used SecureRandom only for initial seeding, then relied on the predictable java.util.Random for all subsequent UUIDs, allowing attackers to predict session IDs. The fix (commit 52b8f34468, released in Spring 4.1.5 and 4.2.0.RC1) replaced it with...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client used AlternativeJdkIdGenerator for session ID generation. This class used SecureRandom only for initial seeding, then relied on the predictable java.util.Random for all subsequent UUIDs, allowing attackers to predict session IDs. The fix (commit 52b8f34468, released in Spring 4.1.5 and 4.2.0.RC1) replaced it with..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:52:09.053481+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. Spring Framework 5.3.21 is not affected by CVE-2015-5211 (Reflected File Download via JSONP). The vulnerability's attack vector (JSONP callback manipulation) was eliminated when JSONP support was completely removed in Spring 5.1 (June 2018). Additionally, the file extension extraction logic was refactored and includes the RFD mitigation. Both architectural changes were present in the upstream v5.3.21 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.3.21 is not affected by CVE-2015-5211 (Reflected File Download via JSONP). The vulnerability's attack vector (JSONP callback manipulation) was eliminated when JSONP support was completely removed in Spring 5.1 (June 2018). Additionally, the file extension extraction logic was refactored and includes the RFD mitigation. Both architectural changes were present in the upstream v5.3.21 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:04:07.366670+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 5.3.21. The vulnerability involved inconsistent URL pattern matching between Spring Security and Spring MVC, allowing authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev) introduced MatchableHandlerMapping interface and HandlerMappingIntrospector to provide a unified request-matching API. This fix was already included in the upstream Spring Framework 5.3.21 release that TuxCare onboarded (first TuxCare commit: 38ea6f530969). The target repository at SHA 87faff353a contains the complete fix implementation in AbstractUrlHandlerMapping (lines 374-386), RequestMappingHandlerMapping (lines 438-447), and HandlerMappingIntrospector (352 lines). The fix is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 5.3.21. The vulnerability involved inconsistent URL pattern matching between Spring Security and Spring MVC, allowing authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev) introduced MatchableHandlerMapping interface and HandlerMappingIntrospector to provide a unified request-matching API. This fix was already included in the upstream Spring Framework 5.3.21 release that TuxCare onboarded (first TuxCare commit: 38ea6f530969). The target repository at SHA 87faff353a contains the complete fix implementation in AbstractUrlHandlerMapping (lines 374-386), RequestMappingHandlerMapping (lines 438-447), and HandlerMappingIntrospector (352 lines). The fix is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:02.040973+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. Spring Framework 5.3.21 is not affected by CVE-2018-11040. The vulnerable JSONP support code (AbstractJsonpResponseBodyAdvice class and JSONP processing in MappingJackson2JsonView) was removed by upstream Spring Framework in commit ac37b678a3 on 2018-06-07 as part of Spring 5.1.0. This removal predates the 5.3.21 release, and the target version never contained the vulnerable functionality. The CVE affects versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, while 5.3.21 belongs to a later version line where JSONP was already removed. TuxCare applied backports for this CVE only to older affected versions (4.3.x, 5.0.5) where the vulnerable code existed, confirming that 5.3.21 does not require such a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.21 is not affected by CVE-2018-11040. The vulnerable JSONP support code (AbstractJsonpResponseBodyAdvice class and JSONP processing in MappingJackson2JsonView) was removed by upstream Spring Framework in commit ac37b678a3 on 2018-06-07 as part of Spring 5.1.0. This removal predates the 5.3.21 release, and the target version never contained the vulnerable functionality. The CVE affects versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, while 5.3.21 belongs to a later version line where JSONP was already removed. TuxCare applied backports for this CVE only to older affected versions (4.3.x, 5.0.5) where the vulnerable code existed, confirming that 5.3.21 does not require such a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T00:52:01.643638+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3 due to improper handling of URL path parameters with special encodings in static resource URLs. The target repository (Spring Framework 5.3.21-tuxcare.6) is not affected because the vulnerability was fixed by upstream Spring Framework developers in March 2018 (SPR-16616) and these fixes were included in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3 due to improper handling of URL path parameters with special encodings in static resource URLs. The target repository (Spring Framework 5.3.21-tuxcare.6) is not affected because the vulnerability was fixed by upstream Spring Framework developers in March 2018 (SPR-16616) and these fixes were included in t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T08:49:57.907521+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Target version 5.3.21 is not affected by CVE-2018-1257. The vulnerability (inability to disable malicious SpEL selector expression parsing) was fixed in upstream Spring Framework 5.0.6/4.3.17 (April 2018). The fix allows administrators to disable the selector header feature via setSelectorHeaderName(null), preventing ReDoS attacks through crafted STOMP subscription messages. This fix was alread...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Target version 5.3.21 is not affected by CVE-2018-1257. The vulnerability (inability to disable malicious SpEL selector expression parsing) was fixed in upstream Spring Framework 5.0.6/4.3.17 (April 2018). The fix allows administrators to disable the selector header feature via setSelectorHeaderName(null), preventing ReDoS attacks through crafted STOMP subscription messages. This fix was alread..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 with authorization bypass via incorrect method resolution on JDK dynamic proxies. The target (Spring Framework 5.3.21-tuxcare.6) is NOT AFFECTED. The vulnerability fixes (commits aa11721ff0 and eaff2c28a7) were applied upstream by jhoeller@pivotal.io in April 2018 and first released in Spring Framework 5.0.6. These fixes were already present in the upstream 5.3.21 release that TuxCare onboarded on 2025-10-29 (commit 38ea6f530969). The vulnerable code pattern (proxy class exclusion in AopUtils.getMostSpecificMethod) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 with authorization bypass via incorrect method resolution on JDK dynamic proxies. The target (Spring Framework 5.3.21-tuxcare.6) is NOT AFFECTED. The vulnerability fixes (commits aa11721ff0 and eaff2c28a7) were applied upstream by jhoeller@pivotal.io in April 2018 and first released in Spring Framework 5.0.6. These fixes were already present in the upstream 5.3.21 release that TuxCare onboarded on 2025-10-29 (commit 38ea6f530969). The vulnerable code pattern (proxy class exclusion in AopUtils.getMostSpecificMethod) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:16:00.114052+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.21 is not affected by CVE-2018-1271. The vulnerability was fixed in upstream Spring Framework 5.0.5 (March 2018) and is included in the 5.3.21 release. The fix adds Windows-style path traversal detection (checking for both \"../\" and \"..\\\") and backslash normalization in resource handlers. The target contains the complete upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.21 is not affected by CVE-2018-1271. The vulnerability was fixed in upstream Spring Framework 5.0.5 (March 2018) and is included in the 5.3.21 release. The fix adds Windows-style path traversal detection (checking for both \"../\" and \"..\\\") and backslash normalization in resource handlers. The target contains the complete upstream fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. CVE-2018-1272 is NOT present in Spring Framework 5.3.21-tuxcare.5. The vulnerability involved predictable multipart boundary generation using weak Random, allowing attackers to inject malicious multipart sections. The target uses SecureRandom for boundary generation (MimeTypeUtils.java:393), making boundaries cryptographically unpredictable. This fix was authored by upstream Spring maintainers (jhoeller@pivotal.io) and shipped in the original 5.3.21 release, prior to TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in Spring Framework 5.3.21-tuxcare.5. The vulnerability involved predictable multipart boundary generation using weak Random, allowing attackers to inject malicious multipart sections. The target uses SecureRandom for boundary generation (MimeTypeUtils.java:393), making boundaries cryptographically unpredictable. This fix was authored by upstream Spring maintainers (jhoeller@pivotal.io) and shipped in the original 5.3.21 release, prior to TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:29:29.992370+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.3.21-tuxcare.5. The vulnerability (DoS via malicious HTTP Range headers with excessive or overlapping ranges) was fixed in the upstream release before TuxCare onboarded this version. Both required defensive validations are present: MAX_RANGES=100 limit (line 136-138) and sum-of-ranges validation (lines 185-195) in HttpRange.java. The fix was authored by rstoyanchev@pivotal.io in upstream and shipped with Spring Framework 5.3.21. TuxCare backported CVE-2018-15756 only to older affected versions (4.3.x, 5.0.x) but not to 5.3.x since it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.3.21-tuxcare.5. The vulnerability (DoS via malicious HTTP Range headers with excessive or overlapping ranges) was fixed in the upstream release before TuxCare onboarded this version. Both required defensive validations are present: MAX_RANGES=100 limit (line 136-138) and sum-of-ranges validation (lines 185-195) in HttpRange.java. The fix was authored by rstoyanchev@pivotal.io in upstream and shipped with Spring Framework 5.3.21. TuxCare backported CVE-2018-15756 only to older affected versions (4.3.x, 5.0.x) but not to 5.3.x since it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:06:00.206020+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.21-tuxcare.5 is NOT affected by CVE-2021-22060. The vulnerability (log injection via newline and control characters) was fixed in upstream Spring Framework 5.3.14, and version 5.3.21 already shipped with the complete fix when TuxCare onboarded it. The fix includes: (1) LogFormatUtils.formatValue() sanitizing newlines to <EOL> and control characters to '?', and (2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.21-tuxcare.5 is NOT affected by CVE-2021-22060. The vulnerability (log injection via newline and control characters) was fixed in upstream Spring Framework 5.3.14, and version 5.3.21 already shipped with the complete fix when TuxCare onboarded it. The fix includes: (1) LogFormatUtils.formatValue() sanitizing newlines to <EOL> and control characters to '?', and (2..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T21:11:00.129913+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.21 is not affected by CVE-2021-22096 (log injection via newline/control characters). The complete upstream fix shipped in the 5.3.21 release: LogFormatUtils.formatValue() sanitizes user-controlled input by replacing newlines with &lt;EOL&gt; and control characters with ?, and all logging statements apply this sanitization. Fix commit 99c7608ffe by upstream author rstoyanche...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.21 is not affected by CVE-2021-22096 (log injection via newline/control characters). The complete upstream fix shipped in the 5.3.21 release: LogFormatUtils.formatValue() sanitizes user-controlled input by replacing newlines with &lt;EOL&gt; and control characters with ?, and all logging statements apply this sanitization. Fix commit 99c7608ffe by upstream author rstoyanche..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:52.088444+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.21-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:221, handler resolution iterates mappings and calls getHandler(request); the class contains no CachedResult, cache filter, or vulnerable cached-URI comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:221, handler resolution iterates mappings and calls getHandler(request); the class contains no CachedResult, cache filter, or vulnerable cached-URI comparison."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.21-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.21-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.3.21-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.21-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.3.21-tuxcare.2."
    }
  ]
}