{
  "@id": "urn:uuid:a067cb49-7d5e-45fd-a966-6d7ee2831d73",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:31:17.527478+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-30T12:16:00.176399+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2009-1190. While the code pattern exists (JdkRegexpMethodPointcut calls Pattern.compile() without validation), the underlying JDK vulnerability is fixed. CVE-2009-1190 affects \"Sun Java Development Kit (JDK) before 1.6\" due to algorithmic complexity in the regex engine. Spring 5.3.24 requires Java 8+ (uses lambdas, streams, and other Java 8 feature...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2009-1190. While the code pattern exists (JdkRegexpMethodPointcut calls Pattern.compile() without validation), the underlying JDK vulnerability is fixed. CVE-2009-1190 affects \"Sun Java Development Kit (JDK) before 1.6\" due to algorithmic complexity in the regex engine. Spring 5.3.24 requires Java 8+ (uses lambdas, streams, and other Java 8 feature..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-06T17:31:17.527478+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.24 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.24 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-03T09:39:00.037443+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.24 is NOT affected by CVE-2011-2894. The vulnerability was fixed in the upstream Spring Framework 3.0.6 release in July 2011 by adding an acceptProxyClasses flag to prevent deserialization of malicious proxy classes. This fix has been present in all subsequent Spring Framework versions, including 5.3.24 which was released in November 2022. The target version contains the co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.24 is NOT affected by CVE-2011-2894. The vulnerability was fixed in the upstream Spring Framework 3.0.6 release in July 2011 by adding an acceptProxyClasses flag to prevent deserialization of malicious proxy classes. This fix has been present in all subsequent Spring Framework versions, including 5.3.24 which was released in November 2022. The target version contains the co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5, caused by improper path prefix handling in StringUtils.cleanPath(). The vulnerability allowed attackers to craft URLs with malicious path prefixes (e.g., /a/:b/../../file) to bypass path normalization and read arbitrary files. The upstream fix (commit 8ee4651038, May 2014) adds valida...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5, caused by improper path prefix handling in StringUtils.cleanPath(). The vulnerability allowed attackers to craft URLs with malicious path prefixes (e.g., /a/:b/../../file) to bypass path normalization and read arbitrary files. The upstream fix (commit 8ee4651038, May 2014) adds valida..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-03T19:06:53.108630+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then predictable java.util.Random). The fix, introduced in 4.1.5 by commit 52b8f34468, replaced AlternativeJdkIdGenerator with JdkIdGenerator (which uses cryptographically secure UUID.randomUUID(...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then predictable java.util.Random). The fix, introduced in 4.1.5 by commit 52b8f34468, replaced AlternativeJdkIdGenerator with JdkIdGenerator (which uses cryptographically secure UUID.randomUUID(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-03T12:58:17.463230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.3.24. The upstream fix commit 2bd1daa75e (\"Protect against RFD exploits\" by rstoyanchev@pivotal.io, dated 2015-10-15) was already included in the upstream Spring Framework release that TuxCare onboarded. The target code contains complete RFD protection: a whitelist of safe file extensions, extraction and validation of request URL extensions (including path parameters), and automatic addition of Content-Disposition headers with safe filenames for any unsafe extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.3.24. The upstream fix commit 2bd1daa75e (\"Protect against RFD exploits\" by rstoyanchev@pivotal.io, dated 2015-10-15) was already included in the upstream Spring Framework release that TuxCare onboarded. The target code contains complete RFD protection: a whitelist of safe file extensions, extraction and validation of request URL extensions (including path parameters), and automatic addition of Content-Disposition headers with safe filenames for any unsafe extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. The CVE-2016-5007 vulnerability is not present in Spring Framework 5.3.24-tuxcare.10. The fix was introduced by upstream Spring Framework in version 4.3.1 (commit a30ab30e4e, April 2016) and was already included in the Spring Framework 5.3.24 release that TuxCare onboarded. The target contains the complete fix: MatchableHandlerMapping interface, HandlerMappingIntrospector class, and implementations in both AbstractUrlHandlerMapping and RequestMappingHandlerMapping that expose Spring MVC's pattern matching logic to authorization components like Spring Security, eliminating pattern matching inconsistencies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The CVE-2016-5007 vulnerability is not present in Spring Framework 5.3.24-tuxcare.10. The fix was introduced by upstream Spring Framework in version 4.3.1 (commit a30ab30e4e, April 2016) and was already included in the Spring Framework 5.3.24 release that TuxCare onboarded. The target contains the complete fix: MatchableHandlerMapping interface, HandlerMappingIntrospector class, and implementations in both AbstractUrlHandlerMapping and RequestMappingHandlerMapping that expose Spring MVC's pattern matching logic to authorization components like Spring Security, eliminating pattern matching inconsistencies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-03T13:52:54.438603+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. Spring Framework 5.3.24 is NOT affected by CVE-2018-11040. The vulnerable JSONP functionality (which allowed automatic cross-domain requests via query parameters \"jsonp\" or \"callback\") was completely removed from Spring Framework in version 5.1.0 (June 2018, commit ac37b678a3) by upstream developer Sebastien Deleuze. This removal occurred long before Spring Framework 5.3.24 was released, meaning the target version never contained the vulnerable code. The fix was part of the upstream Spring Framework release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.24 is NOT affected by CVE-2018-11040. The vulnerable JSONP functionality (which allowed automatic cross-domain requests via query parameters \"jsonp\" or \"callback\") was completely removed from Spring Framework in version 5.1.0 (June 2018, commit ac37b678a3) by upstream developer Sebastien Deleuze. This removal occurred long before Spring Framework 5.3.24 was released, meaning the target version never contained the vulnerable code. The fix was part of the upstream Spring Framework release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-03T00:54:45.999289+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.24-tuxcare.10 is NOT AFFECTED by CVE-2018-1199. The vulnerability pattern (path traversal via encoded URL path parameters) is not present because the upstream Spring Framework 5.3.24 release already included comprehensive fixes for path normalization and encoded traversal validation (commits ea73ec5c41, 0e28bee0f1, and related SPR-16616/SPR-16296 patches). TuxCar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.24-tuxcare.10 is NOT AFFECTED by CVE-2018-1199. The vulnerability pattern (path traversal via encoded URL path parameters) is not present because the upstream Spring Framework 5.3.24 release already included comprehensive fixes for path normalization and encoded traversal validation (commits ea73ec5c41, 0e28bee0f1, and related SPR-16616/SPR-16296 patches). TuxCar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-30T09:05:51.109874+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions where malicious regex in STOMP subscription selector headers can cause ReDoS. The fix that addresses this vulnerability is fully present in the target version 5.3.24: it allows the selector header feature to be disabled entirely by calling setSelectorHeaderName(null), which prevents untrusted selector expressions from being parsed. This fix was in...",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions where malicious regex in STOMP subscription selector headers can cause ReDoS. The fix that addresses this vulnerability is fully present in the target version 5.3.24: it allows the selector header feature to be disabled entirely by calling setSelectorHeaderName(null), which prevents untrusted selector expressions from being parsed. This fix was in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. CVE-2018-1258 authorization bypass vulnerability is NOT present in Spring Framework 5.3.24-tuxcare.10. The fix was already included in the upstream Spring Framework 5.3.24 release. All defensive code patterns are present: AopUtils.getMostSpecificMethod() correctly handles proxy classes (line 196), AnnotationMethodMatcher returns early for proxies (lines 78-80), and CacheAspectSupport/ApplicationListenerMethodAdapter use Proxy.isProxyClass checks (lines 693-694, 112-113 respectively). Fix commits aa11721ff0f and eaff2c28a7 (authored by jhoeller@pivotal.io) are ancestors of the first TuxCare commit 5e37435e9b, confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 authorization bypass vulnerability is NOT present in Spring Framework 5.3.24-tuxcare.10. The fix was already included in the upstream Spring Framework 5.3.24 release. All defensive code patterns are present: AopUtils.getMostSpecificMethod() correctly handles proxy classes (line 196), AnnotationMethodMatcher returns early for proxies (lines 78-80), and CacheAspectSupport/ApplicationListenerMethodAdapter use Proxy.isProxyClass checks (lines 693-694, 112-113 respectively). Fix commits aa11721ff0f and eaff2c28a7 (authored by jhoeller@pivotal.io) are ancestors of the first TuxCare commit 5e37435e9b, confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-30T18:28:50.149316+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2018-1271. The upstream fix for directory traversal vulnerabilities was committed by Rossen Stoyanchev (rstoyanchev@pivotal.io) in March 2018 and shipped in the 5.3.24 release before TuxCare onboarded it in October 2025. The defense includes isInvalidEncodedPath() validation that checks for \"../\" and \"..\\\\\" in URL-decoded paths, and normalizeInputP...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2018-1271. The upstream fix for directory traversal vulnerabilities was committed by Rossen Stoyanchev (rstoyanchev@pivotal.io) in March 2018 and shipped in the 5.3.24 release before TuxCare onboarded it in October 2025. The defense includes isInvalidEncodedPath() validation that checks for \"../\" and \"..\\\\\" in URL-decoded paths, and normalizeInputP..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-03T12:20:19.402749+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. Spring Framework 5.3.24-tuxcare.10 is NOT AFFECTED by CVE-2018-1272. The vulnerability involved predictable multipart boundaries generated using insecure java.util.Random, allowing attackers to inject extra multipart content and manipulate security-critical parts (username, roles). The fix, which replaced Random with SecureRandom in MimeTypeUtils.java, was already present in the upstream Spring Framework 5.3.24 release that TuxCare onboarded. Commit ab2410c754 by upstream maintainer rstoyanchev@pivotal.io (March 2018) implemented the fix over 7 years before TuxCare's onboarding (October 2025). The target uses lazy-initialized SecureRandom for all multipart boundary generation with no vulnerable code paths remaining.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 5.3.24-tuxcare.10 is NOT AFFECTED by CVE-2018-1272. The vulnerability involved predictable multipart boundaries generated using insecure java.util.Random, allowing attackers to inject extra multipart content and manipulate security-critical parts (username, roles). The fix, which replaced Random with SecureRandom in MimeTypeUtils.java, was already present in the upstream Spring Framework 5.3.24 release that TuxCare onboarded. Commit ab2410c754 by upstream maintainer rstoyanchev@pivotal.io (March 2018) implemented the fix over 7 years before TuxCare's onboarding (October 2025). The target uses lazy-initialized SecureRandom for all multipart boundary generation with no vulnerable code paths remaining.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-03T13:33:56.225785+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. CVE-2018-15756 (Spring Framework HTTP Range DoS) - Target version 5.3.24 is NOT AFFECTED. The upstream Spring Framework fix commit 423aa28ed5 by rstoyanchev@pivotal.io was already present in Spring Framework 5.3.24 when TuxCare onboarded it. All three defense mechanisms are present in HttpRange.java: (1) MAX_RANGES=100 limit, (2) range count validation in parseRanges(), and (3) overlapping range validation in toResourceRegions(). The vulnerable code pattern has been removed by the upstream vendor before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 (Spring Framework HTTP Range DoS) - Target version 5.3.24 is NOT AFFECTED. The upstream Spring Framework fix commit 423aa28ed5 by rstoyanchev@pivotal.io was already present in Spring Framework 5.3.24 when TuxCare onboarded it. All three defense mechanisms are present in HttpRange.java: (1) MAX_RANGES=100 limit, (2) range count validation in parseRanges(), and (3) overlapping range validation in toResourceRegions(). The vulnerable code pattern has been removed by the upstream vendor before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-31T20:19:00.105438+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2021-22060 (log injection vulnerability). The vulnerable pattern has been removed by upstream fix commits that shipped in the Spring Framework 5.3.24 release, prior to any TuxCare modifications. The fix includes: (1) LogFormatUtils.formatValue() that sanitizes newline and control characters by replacing them with <EOL> and ?, and (2) application of...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.24 is not affected by CVE-2021-22060 (log injection vulnerability). The vulnerable pattern has been removed by upstream fix commits that shipped in the Spring Framework 5.3.24 release, prior to any TuxCare modifications. The fix includes: (1) LogFormatUtils.formatValue() that sanitizes newline and control characters by replacing them with <EOL> and ?, and (2) application of..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-31T21:18:39.525767+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newline characters) is NOT present in Spring Framework 5.3.24-tuxcare.10. The upstream fix (commit 99c7608ffe by Rossen Stoyanchev) shipped in Spring Framework 5.3.24 before TuxCare onboarded this version. The fix adds sanitization in LogFormatUtils.formatValue() that replaces newline characters (\\n, \\r) with <EOL> and control characters with ? before logging. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newline characters) is NOT present in Spring Framework 5.3.24-tuxcare.10. The upstream fix (commit 99c7608ffe by Rossen Stoyanchev) shipped in Spring Framework 5.3.24 before TuxCare onboarded this version. The fix adds sanitization in LogFormatUtils.formatValue() that replaces newline characters (\\n, \\r) with <EOL> and control characters with ? before logging. ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.3.24-tuxcare.10 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.3.24-tuxcare.10 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-15T22:32:00.153307+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.24-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-15T22:32:00.153307+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}