{
  "@id": "urn:uuid:8de6dce6-9e6a-4d63-9769-b8c63176b4a3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 54,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:22:17.110385+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T11:55:34.415642+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6. Spring Framework 5.3.30 requires JDK 8+ (confirmed by sourceCompatibility=1.8 in build.gradle), which includes the fix for this vulnerability. While Spring's PatternEditor still calls Pattern.compile without validation, the underlying JDK runtime provides protection against the ...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6. Spring Framework 5.3.30 requires JDK 8+ (confirmed by sourceCompatibility=1.8 in build.gradle), which includes the fix for this vulnerability. While Spring's PatternEditor still calls Pattern.compile without validation, the underlying JDK runtime provides protection against the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:28:07.287293+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.30 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.30 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:32:31.968170+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target version 5.3.30 contains the upstream fix for CVE-2011-2894 (added by Spring/VMware in July 2011). The fix adds an optional `acceptProxyClasses` flag to block proxy class deserialization, mitigating the arbitrary code execution vulnerability. However, the defense defaults to `true` (permissive) and requires explicit configuration to activate. The affected remoting classes are also depreca...",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Target version 5.3.30 contains the upstream fix for CVE-2011-2894 (added by Spring/VMware in July 2011). The fix adds an optional `acceptProxyClasses` flag to block proxy class deserialization, mitigating the arbitrary code execution vulnerability. However, the defense defaults to `true` (permissive) and requires explicit configuration to activate. The affected remoting classes are also depreca..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework's StringUtils.cleanPath() method that allowed attackers to bypass path normalization by injecting colons mid-path (e.g., /a/:b/../../sensitive). The fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already present in the upstream Spring Framework 5.3.30 release that TuxCare onboarded, authored by rstoyanchev@gopiv...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework's StringUtils.cleanPath() method that allowed attackers to bypass path normalization by injecting colons mid-path (e.g., /a/:b/../../sensitive). The fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already present in the upstream Spring Framework 5.3.30 release that TuxCare onboarded, authored by rstoyanchev@gopiv..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:00.096825+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used SecureRandom only for initial seed, then java.util.Random). The target (Spring Framework 5.3.30) already contains the upstream fix from commit 52b8f34468330372f448ee13475b0a6982ee0809 (authored by rstoyanchev@pivotal.io, dated Jan 22 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used SecureRandom only for initial seed, then java.util.Random). The target (Spring Framework 5.3.30) already contains the upstream fix from commit 52b8f34468330372f448ee13475b0a6982ee0809 (authored by rstoyanchev@pivotal.io, dated Jan 22 20..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:52:53.936815+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.30 is not affected by CVE-2015-5211 (Reflected File Download attack). The RFD defense mechanism was already present in the upstream Spring Framework 5.3.30 release that TuxCare onboarded. The fix (commit 2bd1daa75e by Rossen Stoyanchev, October 2015) includes Content-Disposition header protection in AbstractMessageConverterMethodProcessor that validates URL file extensions against a whitelist and forces safe download filenames for dangerous extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.3.30 is not affected by CVE-2015-5211 (Reflected File Download attack). The RFD defense mechanism was already present in the upstream Spring Framework 5.3.30 release that TuxCare onboarded. The fix (commit 2bd1daa75e by Rossen Stoyanchev, October 2015) includes Content-Disposition header protection in AbstractMessageConverterMethodProcessor that validates URL file extensions against a whitelist and forces safe download filenames for dangerous extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:05:07.573388+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.30 is not affected by CVE-2016-5007. The vulnerability was fixed in Spring Framework 4.3.1 (April 2016) by introducing the HandlerMappingIntrospector API (commit 16949941f8), which allows Spring Security to use the same URL pattern matching logic as Spring MVC. This fix was already present in the upstream Spring Framework 5.3.30 release that TuxCare onboarded, eliminating the pattern matching discrepancies that could lead to authorization bypass. The fix was authored by upstream developer Juergen Hoeller (jhoeller@pivotal.io), not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.3.30 is not affected by CVE-2016-5007. The vulnerability was fixed in Spring Framework 4.3.1 (April 2016) by introducing the HandlerMappingIntrospector API (commit 16949941f8), which allows Spring Security to use the same URL pattern matching logic as Spring MVC. This fix was already present in the upstream Spring Framework 5.3.30 release that TuxCare onboarded, eliminating the pattern matching discrepancies that could lead to authorization bypass. The fix was authored by upstream developer Juergen Hoeller (jhoeller@pivotal.io), not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:33.672370+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.30 is not affected by CVE-2018-11040. The vulnerable JSONP support code has been completely removed from the codebase in upstream commit ac37b678a3 (June 2018), which predates TuxCare's onboarding of this version by over 7 years. The MappingJackson2JsonView class no longer contains the jsonpParameterNames field or any JSONP query parameter handling logic. The entire JSONP feature was removed upstream, eliminating the cross-domain request vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.30 is not affected by CVE-2018-11040. The vulnerable JSONP support code has been completely removed from the codebase in upstream commit ac37b678a3 (June 2018), which predates TuxCare's onboarding of this version by over 7 years. The MappingJackson2JsonView class no longer contains the jsonpParameterNames field or any JSONP query parameter handling logic. The entire JSONP feature was removed upstream, eliminating the cross-domain request vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T00:50:03.356713+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2018-1199. The vulnerability allowed bypassing security constraints on static resources through specially-encoded URL paths (double slashes, backslashes, encoded separators). The upstream Spring Framework developers fixed this issue in commits ea73ec5c41, 6d26e61ac7, 0e28bee0f1, 91b803a231, f59ea610df, and 13356a7ee2 (SPR-16616, SPR-16296, SPR-1652...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2018-1199. The vulnerability allowed bypassing security constraints on static resources through specially-encoded URL paths (double slashes, backslashes, encoded separators). The upstream Spring Framework developers fixed this issue in commits ea73ec5c41, 6d26e61ac7, 0e28bee0f1, 91b803a231, f59ea610df, and 13356a7ee2 (SPR-16616, SPR-16296, SPR-1652..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T08:49:57.907521+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with STOMP over WebSocket support that allowed regex DoS attacks through malicious selector headers. The target (5.3.30) is NOT AFFECTED because the upstream fix was already present in the Spring Framework 5.3.x release line before TuxCare's involvement. The fix (commit ff2228fdaf) by upstream developer rstoyanchev@pivotal.io added a null-check de...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with STOMP over WebSocket support that allowed regex DoS attacks through malicious selector headers. The target (5.3.30) is NOT AFFECTED because the upstream fix was already present in the Spring Framework 5.3.x release line before TuxCare's involvement. The fix (commit ff2228fdaf) by upstream developer rstoyanchev@pivotal.io added a null-check de..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 where method security annotations on proxied beans were not properly detected, allowing authorization bypass. The vulnerability was caused by incorrect method resolution that excluded JDK dynamic proxy classes, preventing security annotations from being discovered. The fix (commits aa11721 and eaff2c28 from April 2018) was already present in upstream Spring Framework 5.3.30, which was released long after the CVE. The target version 5.3.30-tuxcare.13 inherited the fix from the upstream release before TuxCare began maintaining this branch. All affected files (AopUtils.java, AnnotationMethodMatcher.java, CacheAspectSupport.java, CacheOperationExpressionEvaluator.java) contain the corrected method resolution logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 where method security annotations on proxied beans were not properly detected, allowing authorization bypass. The vulnerability was caused by incorrect method resolution that excluded JDK dynamic proxy classes, preventing security annotations from being discovered. The fix (commits aa11721 and eaff2c28 from April 2018) was already present in upstream Spring Framework 5.3.30, which was released long after the CVE. The target version 5.3.30-tuxcare.13 inherited the fix from the upstream release before TuxCare began maintaining this branch. All affected files (AopUtils.java, AnnotationMethodMatcher.java, CacheAspectSupport.java, CacheOperationExpressionEvaluator.java) contain the corrected method resolution logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:18:00.120764+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.30. The upstream fix was already included in the Spring Framework 5.3.30 release that TuxCare onboarded. All four affected resource handler files contain the complete mitigation: isInvalidEncodedPath() methods check for both \"../\" and \"..\\\\\" patterns in URL-decoded paths, and processPath() methods normalize b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.30. The upstream fix was already included in the Spring Framework 5.3.30 release that TuxCare onboarded. All four affected resource handler files contain the complete mitigation: isInvalidEncodedPath() methods check for both \"../\" and \"..\\\\\" patterns in URL-decoded paths, and processPath() methods normalize b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.30 is not affected by CVE-2018-1272. The vulnerable pattern (predictable multipart boundaries using weak java.util.Random) is not present in the target. The upstream fix (using java.security.SecureRandom for boundary generation) was committed in March 2018 (ab2410c754) and is present in the Spring Framework 5.3.30 release (September 2023). The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from the Spring team, not TuxCare/CloudLinux. TuxCare backported this CVE to older affected versions (3.x, 4.x, 5.0.0) but did not need to backport to 5.3.30 as it already contained the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 5.3.30 is not affected by CVE-2018-1272. The vulnerable pattern (predictable multipart boundaries using weak java.util.Random) is not present in the target. The upstream fix (using java.security.SecureRandom for boundary generation) was committed in March 2018 (ab2410c754) and is present in the Spring Framework 5.3.30 release (September 2023). The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from the Spring team, not TuxCare/CloudLinux. TuxCare backported this CVE to older affected versions (3.x, 4.x, 5.0.0) but did not need to backport to 5.3.30 as it already contained the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:30:30.768655+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. The target (Spring Framework 5.3.30-tuxcare.12) is not affected by CVE-2018-15756. The vulnerability required two defenses: (1) limiting Range header requests to max 100 ranges, and (2) validating that the sum of overlapping ranges does not exceed the resource length. Both defenses are present in the target code at HttpRange.java lines 48, 136-138, and 185-195. The fix was authored by the upstream Spring team (Rossen Stoyanchev, rstoyanchev@pivotal.io) and shipped in the Spring 5.3.30 upstream release before TuxCare onboarded this version. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target (Spring Framework 5.3.30-tuxcare.12) is not affected by CVE-2018-15756. The vulnerability required two defenses: (1) limiting Range header requests to max 100 ranges, and (2) validating that the sum of overlapping ranges does not exceed the resource length. Both defenses are present in the target code at HttpRange.java lines 48, 136-138, and 185-195. The fix was authored by the upstream Spring team (Rossen Stoyanchev, rstoyanchev@pivotal.io) and shipped in the Spring 5.3.30 upstream release before TuxCare onboarded this version. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:09:20.810528+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 affects Spring Framework 5.3.0-5.3.13. The target version 5.3.30 is not vulnerable because the fix was already present in the upstream Spring Framework 5.3.30 release. The vulnerability allowed log injection via malicious input containing newline and control characters. The fix adds LogFormatUtils.formatValue() which sanitizes logged strings by replacing newlines with &lt;EOL&gt;...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 affects Spring Framework 5.3.0-5.3.13. The target version 5.3.30 is not vulnerable because the fix was already present in the upstream Spring Framework 5.3.30 release. The vulnerability allowed log injection via malicious input containing newline and control characters. The fix adds LogFormatUtils.formatValue() which sanitizes logged strings by replacing newlines with &lt;EOL&gt;..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:12:52.953367+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) is not present in Spring Framework 5.3.30. The upstream vendor fix was already included in the 5.3.14 release (Dec 2021), well before version 5.3.30. The fix adds LogFormatUtils sanitization that replaces newlines with <EOL> and control characters with '?' before logging user-controlled data. All vulnerable code paths have been reme...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) is not present in Spring Framework 5.3.30. The upstream vendor fix was already included in the 5.3.14 release (Dec 2021), well before version 5.3.30. The fix adds LogFormatUtils sanitization that replaces newlines with <EOL> and control characters with '?' before logging user-controlled data. All vulnerable code paths have been reme..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:17.110385+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.30-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the cached request URI comparison that treats attacker input as a regular expression. HandlerMappingIntrospector performs a direct handler lookup instead, as shown in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:237.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the cached request URI comparison that treats attacker input as a regular expression. HandlerMappingIntrospector performs a direct handler lookup instead, as shown in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:237."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.30-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.30-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.30-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.30-tuxcare.5."
    }
  ]
}