{
  "@id": "urn:uuid:6fb6f689-6ba0-47c5-b560-fcb98281963b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 53,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:21:52.088444+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T11:52:00.175545+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6. Spring Framework 5.3.31 requires JDK 8+ (confirmed in src/docs/asciidoc/overview.adoc line 11), which includes the fix introduced in JDK 1.6 (2006). While PatternEditor.java still calls Pattern.compile without validation (line 62, unchanged since 2008), the vulnerable JDK implem...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6. Spring Framework 5.3.31 requires JDK 8+ (confirmed in src/docs/asciidoc/overview.adoc line 11), which includes the fix introduced in JDK 1.6 (2006). While PatternEditor.java still calls Pattern.compile without validation (line 62, unchanged since 2008), the vulnerable JDK implem..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-06T17:27:00.045113+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.31 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.31 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T09:33:28.119742+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 is NOT present in Spring Framework 5.3.31-tuxcare.15. The vulnerability allowed remote code execution through deserialization of untrusted proxy classes. The fix (acceptProxyClasses flag with validation) was introduced by upstream Spring Framework in July 2011 (commit 7d8aa05c by Juergen Hoeller) and shipped in Spring Framework 3.1.0.RELEASE (December 2011). Since the target versi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is NOT present in Spring Framework 5.3.31-tuxcare.15. The vulnerability allowed remote code execution through deserialization of untrusted proxy classes. The fix (acceptProxyClasses flag with validation) was introduced by upstream Spring Framework in July 2011 (commit 7d8aa05c by Juergen Hoeller) and shipped in Spring Framework 3.1.0.RELEASE (December 2011). Since the target versi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 Target version 5.3.31 contains the fix for CVE-2014-3578. The vulnerable code pattern (unchecked prefix extraction allowing directory traversal via crafted paths like /a/:b/../../file) is not present. The fix, which validates that extracted URI scheme prefixes do not contain forward slashes, is present at StringUtils.java:710-712. This fix was introduced by upstream commit 8ee465103850a3dca0182...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 Target version 5.3.31 contains the fix for CVE-2014-3578. The vulnerable code pattern (unchecked prefix extraction allowing directory traversal via crafted paths like /a/:b/../../file) is not present. The fix, which validates that extracted URI scheme prefixes do not contain forward slashes, is present at StringUtils.java:710-712. This fix was introduced by upstream commit 8ee465103850a3dca0182..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T19:03:00.072111+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (SecureRandom for seed, then regular Random). The target version 5.3.31 contains the upstream fix from v4.1.5 (commit 52b8f34468) which replaced AlternativeJdkIdGenerator with JdkIdGenerator that uses UUID.randomUUID() for cryptographically sec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (SecureRandom for seed, then regular Random). The target version 5.3.31 contains the upstream fix from v4.1.5 (commit 52b8f34468) which replaced AlternativeJdkIdGenerator with JdkIdGenerator that uses UUID.randomUUID() for cryptographically sec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T12:51:28.138223+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download) is not present in Spring Framework 5.3.31. The vulnerability was fixed by upstream Spring in October 2015 (commit 2bd1daa75ee0b8ec33608ca6ab065ef3e1815543) before TuxCare onboarded this version. The vulnerable code patterns have been removed and replaced with secure implementations: (1) URL parameter stripping is implemented in UriUtils.extractFileExtension() which properly strips query (?), fragment (#), and path (;) parameters before file extension extraction; (2) JSONP support (another attack vector) was completely removed from Spring 5.x; (3) Additional Content-Disposition header protection was added to prevent RFD exploits. The fix is used by PathExtensionContentNegotiationStrategy and other content negotiation components.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download) is not present in Spring Framework 5.3.31. The vulnerability was fixed by upstream Spring in October 2015 (commit 2bd1daa75ee0b8ec33608ca6ab065ef3e1815543) before TuxCare onboarded this version. The vulnerable code patterns have been removed and replaced with secure implementations: (1) URL parameter stripping is implemented in UriUtils.extractFileExtension() which properly strips query (?), fragment (#), and path (;) parameters before file extension extraction; (2) JSONP support (another attack vector) was completely removed from Spring 5.x; (3) Additional Content-Disposition header protection was added to prevent RFD exploits. The fix is used by PathExtensionContentNegotiationStrategy and other content negotiation components.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T13:03:12.649222+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 5.3.31-tuxcare.15. The vulnerability concerned inconsistent URL pattern matching between Spring Security and Spring MVC, where differences in pattern matching strictness (e.g., space trimming) could allow Spring Security to fail to recognize certain paths as protected. The fix (HandlerMappingIntrospector API introduced in commit a30ab30e4e9ae021fdda04e9abfc228476b846b5) is present in the target and was already included in the upstream Spring Framework 5.3.31 release before TuxCare onboarded it. The vulnerable pattern (absence of a consistent pattern-matching introspection API) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 5.3.31-tuxcare.15. The vulnerability concerned inconsistent URL pattern matching between Spring Security and Spring MVC, where differences in pattern matching strictness (e.g., space trimming) could allow Spring Security to fail to recognize certain paths as protected. The fix (HandlerMappingIntrospector API introduced in commit a30ab30e4e9ae021fdda04e9abfc228476b846b5) is present in the target and was already included in the upstream Spring Framework 5.3.31 release before TuxCare onboarded it. The vulnerable pattern (absence of a consistent pattern-matching introspection API) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T13:47:16.155569+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. The target Spring Framework 5.3.31-tuxcare.15 is NOT AFFECTED by CVE-2018-11040. The vulnerable JSONP support was completely removed from Spring Framework in upstream version 5.1.0.RC1 (June 2018) via commit ac37b678a3 by Sebastien Deleuze. Since the target version 5.3.31 is significantly newer than 5.1.0, it inherited this removal from the upstream release. The JSONP-related code (MappingJackson2JsonView.jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, MappingJacksonValue.jsonpFunction methods) does not exist in the codebase. This is an upstream fix that shipped in the base release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target Spring Framework 5.3.31-tuxcare.15 is NOT AFFECTED by CVE-2018-11040. The vulnerable JSONP support was completely removed from Spring Framework in upstream version 5.1.0.RC1 (June 2018) via commit ac37b678a3 by Sebastien Deleuze. Since the target version 5.3.31 is significantly newer than 5.1.0, it inherited this removal from the upstream release. The JSONP-related code (MappingJackson2JsonView.jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, MappingJacksonValue.jsonpFunction methods) does not exist in the codebase. This is an upstream fix that shipped in the base release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T00:51:50.423387+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.3.31-tuxcare.15. The vulnerability allowed attackers to bypass security constraints using specially-encoded URL path parameters (e.g., %2E%2E for ..) to achieve path traversal. The upstream Spring Framework team fixed this in March 2018 (commits 91b803a2310 and 98ad23bef8e) by adding comprehensive path normalization (backslash-to-slash conversi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.3.31-tuxcare.15. The vulnerability allowed attackers to bypass security constraints using specially-encoded URL path parameters (e.g., %2E%2E for ..) to achieve path traversal. The upstream Spring Framework team fixed this in March 2018 (commits 91b803a2310 and 98ad23bef8e) by adding comprehensive path normalization (backslash-to-slash conversi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T08:47:11.256466+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.31 is not affected by CVE-2018-1257. The vulnerability was fixed in the upstream Spring Framework in April 2018 (commit ff2228fdaf1), long before the 5.3.31 release in November 2023. The fix allows disabling the selector header feature entirely by setting selectorHeaderName to null, which prevents malicious selector expressions from being parsed and causing a reg...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.31 is not affected by CVE-2018-1257. The vulnerability was fixed in the upstream Spring Framework in April 2018 (commit ff2228fdaf1), long before the 5.3.31 release in November 2023. The fix allows disabling the selector header feature entirely by setting selectorHeaderName to null, which prevents malicious selector expressions from being parsed and causing a reg..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. CVE-2018-1258 (authorization bypass via proxy method resolution) was fixed by upstream Spring Framework in April 2018, more than 2 years before the 5.3.0 release. The target repository at version 5.3.31 contains the upstream fix commits (aa11721ff0 and eaff2c28a7) authored by Juergen Hoeller. Both commits predate the first TuxCare commit (349f0644a1, June 2024) by over 6 years. The vulnerable pattern (proxy class exclusion in method resolution) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 (authorization bypass via proxy method resolution) was fixed by upstream Spring Framework in April 2018, more than 2 years before the 5.3.0 release. The target repository at version 5.3.31 contains the upstream fix commits (aa11721ff0 and eaff2c28a7) authored by Juergen Hoeller. Both commits predate the first TuxCare commit (349f0644a1, June 2024) by over 6 years. The vulnerable pattern (proxy class exclusion in method resolution) is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T18:14:00.120674+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 5.3.31. The vulnerability was a directory traversal attack via URL-encoded path sequences (e.g., %2E%2E/ for ../) when serving static resources from Windows file systems. The upstream fix, authored by Juergen Hoeller (jhoeller@pivotal.io) and committed as 13356a7ee2, shipped in the upstream release before TuxCare onboarding. The fix adds isInvali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 5.3.31. The vulnerability was a directory traversal attack via URL-encoded path sequences (e.g., %2E%2E/ for ../) when serving static resources from Windows file systems. The upstream fix, authored by Juergen Hoeller (jhoeller@pivotal.io) and committed as 13356a7ee2, shipped in the upstream release before TuxCare onboarding. The fix adds isInvali..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. Target Spring Framework 5.3.31 is not vulnerable to CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak Random, enabling attackers to inject malicious multipart sections. The fix (using SecureRandom) was introduced in upstream v5.0.5 (commit ab2410c754, March 2018) and is present in v5.3.31. Current code uses lazy-initialized SecureRandom at MimeTypeUtils.java:393.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Target Spring Framework 5.3.31 is not vulnerable to CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak Random, enabling attackers to inject malicious multipart sections. The fix (using SecureRandom) was introduced in upstream v5.0.5 (commit ab2410c754, March 2018) and is present in v5.3.31. Current code uses lazy-initialized SecureRandom at MimeTypeUtils.java:393.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T13:29:29.992370+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. CVE-2018-15756 addresses HTTP Range Request DoS vulnerability in Spring Framework. The target version 5.3.31 is NOT vulnerable. The upstream fix (commit 423aa28ed5 by Rossen Stoyanchev) that adds validation to limit the number of ranges to 100 and prevent overlapping ranges from exceeding resource length was already present in the upstream Spring Framework 5.3.31 release, before TuxCare maintenance began. Both required defenses are confirmed present in the target code: (1) MAX_RANGES=100 constant with enforcement at parseRanges(), and (2) sum-of-ranges validation in toResourceRegions(). The vulnerable pattern (unrestricted range processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 addresses HTTP Range Request DoS vulnerability in Spring Framework. The target version 5.3.31 is NOT vulnerable. The upstream fix (commit 423aa28ed5 by Rossen Stoyanchev) that adds validation to limit the number of ranges to 100 and prevent overlapping ranges from exceeding resource length was already present in the upstream Spring Framework 5.3.31 release, before TuxCare maintenance began. Both required defenses are confirmed present in the target code: (1) MAX_RANGES=100 constant with enforcement at parseRanges(), and (2) sum-of-ranges validation in toResourceRegions(). The vulnerable pattern (unrestricted range processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:05:00.136570+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 The target (Spring Framework 5.3.31-tuxcare.15) is NOT AFFECTED by CVE-2021-22060. The vulnerability involves log injection through unescaped newline and control characters in user-controlled input. The fix, which adds LogFormatUtils.formatValue() to sanitize input before logging (replacing newlines with <EOL> and control characters with ?), was included in upstream Spring Framework 5.3.14. Sin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Framework 5.3.31-tuxcare.15) is NOT AFFECTED by CVE-2021-22060. The vulnerability involves log injection through unescaped newline and control characters in user-controlled input. The fix, which adds LogFormatUtils.formatValue() to sanitize input before logging (replacing newlines with <EOL> and control characters with ?), was included in upstream Spring Framework 5.3.14. Sin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T21:09:40.664105+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 log injection vulnerability is not present in Spring Framework 5.3.31-tuxcare.15. The upstream fix, which sanitizes newline and control characters in log messages, was already included in the upstream v5.3.31 release. The fix adds pattern-based replacement of newlines with &lt;EOL&gt; and control characters with ? in LogFormatUtils.java, and applies this sanitization across 28 fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 log injection vulnerability is not present in Spring Framework 5.3.31-tuxcare.15. The upstream fix, which sanitizes newline and control characters in log messages, was already included in the upstream v5.3.31 release. The fix adds pattern-based replacement of newlines with &lt;EOL&gt; and control characters with ? in LogFormatUtils.java, and applies this sanitization across 28 fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:52.088444+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.31.tuxcare of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the vulnerable request-URI cache or its regular-expression comparison. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, getMatchableHandlerMapping wraps the request and resolves its handler mapping directly, without using that cache.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the vulnerable request-URI cache or its regular-expression comparison. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, getMatchableHandlerMapping wraps the request and resolves its handler mapping directly, without using that cache."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.3.31.tuxcare of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.3.31.tuxcare of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.31.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.31.tuxcare of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.31.tuxcare of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.7."
    }
  ]
}