{
  "@id": "urn:uuid:bc558976-0b45-4ea2-a6a9-3b4ab911d99c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:25:00.091559+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:58:00.178249+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before version 1.6. While Spring Framework 5.3.32 contains the deserialization mechanism (HttpInvokerServiceExporter) and Pattern.compile() usage (PatternEditor) that could trigger this vulnerability, the target is NOT AFFECTED because it requires JDK 8+ (confirmed by .sdkmanrc showing ...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before version 1.6. While Spring Framework 5.3.32 contains the deserialization mechanism (HttpInvokerServiceExporter) and Pattern.compile() usage (PatternEditor) that could trigger this vulnerability, the target is NOT AFFECTED because it requires JDK 8+ (confirmed by .sdkmanrc showing ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:12.209513+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.32 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.32 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:51:00.166719+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 and involves unsafe deserialization of proxy classes that allows remote code execution. The target repository (Spring Framework 5.3.32) is NOT affected because the fix was already present in the upstream release. The vulnerability was fixed upstream in July 2011 by commit 7d8aa05c4071 which added an acceptProxyClasses flag and validation in Con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 and involves unsafe deserialization of proxy classes that allows remote code execution. The target repository (Spring Framework 5.3.32) is NOT affected because the fix was already present in the upstream release. The vulnerability was fixed upstream in July 2011 by commit 7d8aa05c4071 which added an acceptProxyClasses flag and validation in Con..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.32-tuxcare.4. The directory traversal vulnerability via crafted URL with colon character was fixed in the upstream Spring Framework release 5.3.32 (commit 8ee465103850a3dca by Rossen Stoyanchev, addressing SPR-11793). The fix validates that prefixes before colons don't contain forward slashes, preventing path traversal exploitation. TuxCare o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.32-tuxcare.4. The directory traversal vulnerability via crafted URL with colon character was fixed in the upstream Spring Framework release 5.3.32 (commit 8ee465103850a3dca by Rossen Stoyanchev, addressing SPR-11793). The fix validates that prefixes before colons don't contain forward slashes, preventing path traversal exploitation. TuxCare o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:19:36.318385+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator. The vulnerability was fixed in upstream commit 52b8f34468 (January 2015) by replacing it with JdkIdGenerator that uses cryptographically secure UUID.randomUUID(). The target version 5.3.32 already contains this upstream fix, which was present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator. The vulnerability was fixed in upstream commit 52b8f34468 (January 2015) by replacing it with JdkIdGenerator that uses cryptographically secure UUID.randomUUID(). The target version 5.3.32 already contains this upstream fix, which was present..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is not present in Spring Framework 5.3.32. The vulnerability was fixed by upstream Spring in version 4.2.2 (October 2015, commit 2bd1daa75e), and this fix shipped with the original 5.3.32 release. The target contains comprehensive RFD protections: Content-Disposition header enforcement for unsafe file extensions (AbstractMessageConverterMethodProcessor.java:414-452), safe extension whitelisting (lines 78-81), path validation (AbstractSockJsService.java:517-521), and JSONP support was completely removed in 2018 (commit ac37b678a3), eliminating the callback injection vector entirely. All protections are active by default with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is not present in Spring Framework 5.3.32. The vulnerability was fixed by upstream Spring in version 4.2.2 (October 2015, commit 2bd1daa75e), and this fix shipped with the original 5.3.32 release. The target contains comprehensive RFD protections: Content-Disposition header enforcement for unsafe file extensions (AbstractMessageConverterMethodProcessor.java:414-452), safe extension whitelisting (lines 78-81), path validation (AbstractSockJsService.java:517-521), and JSONP support was completely removed in 2018 (commit ac37b678a3), eliminating the callback injection vector entirely. All protections are active by default with no configuration required.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:18:44.496921+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 addresses pattern matching inconsistencies between Spring Security and Spring MVC that could allow authorization bypass. The vulnerability was fixed in Spring Framework 4.3.1 (April 2016) by introducing the HandlerMappingIntrospector API, which provides a unified way for security layers to query MVC's actual pattern matching behavior. The target repository (Spring Framework 5.3.32) already contains this fix as it was included in the upstream release that TuxCare onboarded. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from Pivotal, not by TuxCare. All key components are present: HandlerMappingIntrospector, MatchableHandlerMapping interface, and proper implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The vulnerable pattern (lack of introspection API) is not present in version 5.3.32.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses pattern matching inconsistencies between Spring Security and Spring MVC that could allow authorization bypass. The vulnerability was fixed in Spring Framework 4.3.1 (April 2016) by introducing the HandlerMappingIntrospector API, which provides a unified way for security layers to query MVC's actual pattern matching behavior. The target repository (Spring Framework 5.3.32) already contains this fix as it was included in the upstream release that TuxCare onboarded. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from Pivotal, not by TuxCare. All key components are present: HandlerMappingIntrospector, MatchableHandlerMapping interface, and proper implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The vulnerable pattern (lack of introspection API) is not present in version 5.3.32.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:13.058306+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.32 is NOT affected by CVE-2018-11040. JSONP support was completely removed from the upstream Spring Framework in June 2018 (commit ac37b678a3ac9ee541a10e8ad74d612bb9ec5b88 by Sebastien Deleuze) and this removal was already present in the upstream release 5.3.32 that TuxCare onboarded. The vulnerable code (MappingJackson2JsonView with jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, and JSONP transport handlers) does not exist in the target. The CVE affects versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18; version 5.3.32 is significantly newer and ships without any JSONP functionality.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.32 is NOT affected by CVE-2018-11040. JSONP support was completely removed from the upstream Spring Framework in June 2018 (commit ac37b678a3ac9ee541a10e8ad74d612bb9ec5b88 by Sebastien Deleuze) and this removal was already present in the upstream release 5.3.32 that TuxCare onboarded. The vulnerable code (MappingJackson2JsonView with jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, and JSONP transport handlers) does not exist in the target. The CVE affects versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18; version 5.3.32 is significantly newer and ships without any JSONP functionality.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:14:00.204394+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 describes a path traversal vulnerability where attackers could bypass security constraints on static resources by using URL path parameters with special encodings. The target (spring-framework 5.3.32-tuxcare.4) is NOT affected because the upstream fix was already present in the Spring Framework 5.3.0 release (March 2018) that TuxCare onboarded. The fix includes: (1) path normaliza...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 describes a path traversal vulnerability where attackers could bypass security constraints on static resources by using URL path parameters with special encodings. The target (spring-framework 5.3.32-tuxcare.4) is NOT affected because the upstream fix was already present in the Spring Framework 5.3.0 release (March 2018) that TuxCare onboarded. The fix includes: (1) path normaliza..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.32 is NOT AFFECTED by CVE-2018-1258. The vulnerability was an authorization bypass in Spring Framework 5.0.5 when used with Spring Security method security, caused by incorrect method resolution in expression evaluators when handling proxy classes. The upstream vendor (Pivotal/Spring) fixed this vulnerability in commits aa11721ff0 and eaff2c28a7 (April 2018) by: (1) removing the proxy class exclusion from AopUtils.getMostSpecificMethod(), (2) adding early proxy detection in AnnotationMethodMatcher, and (3) ensuring consistent target method resolution in CacheAspectSupport and ApplicationListenerMethodAdapter. These fixes were already present in the upstream Spring Framework 5.3.32 release that TuxCare onboarded (commit 0632462efc), meaning the vulnerable code pattern never existed in this version branch. All affected files (AopUtils.java, AnnotationMethodMatcher.java, CacheAspectSupport.java, ApplicationListenerMethodAdapter.java) contain the fixed code at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.3.32 is NOT AFFECTED by CVE-2018-1258. The vulnerability was an authorization bypass in Spring Framework 5.0.5 when used with Spring Security method security, caused by incorrect method resolution in expression evaluators when handling proxy classes. The upstream vendor (Pivotal/Spring) fixed this vulnerability in commits aa11721ff0 and eaff2c28a7 (April 2018) by: (1) removing the proxy class exclusion from AopUtils.getMostSpecificMethod(), (2) adding early proxy detection in AnnotationMethodMatcher, and (3) ensuring consistent target method resolution in CacheAspectSupport and ApplicationListenerMethodAdapter. These fixes were already present in the upstream Spring Framework 5.3.32 release that TuxCare onboarded (commit 0632462efc), meaning the vulnerable code pattern never existed in this version branch. All affected files (AopUtils.java, AnnotationMethodMatcher.java, CacheAspectSupport.java, ApplicationListenerMethodAdapter.java) contain the fixed code at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:09:00.107947+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.32. The fix was already included in the upstream release prior to TuxCare onboarding. All defense mechanisms from the vendor patches are present and active: URL decoding before path validation, rejection of both Unix (../) and Windows (..\\) directory traversal sequences, backslash normalization, and duplicate...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.32. The fix was already included in the upstream release prior to TuxCare onboarding. All defense mechanisms from the vendor patches are present and active: URL decoding before path validation, rejection of both Unix (../) and Windows (..\\) directory traversal sequences, backslash normalization, and duplicate..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. The target (Spring Framework 5.3.32) is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak `Random`, enabling boundary injection attacks where an attacker could craft input containing valid boundary strings to cause multipart parsers to misinterpret the request structure. The fix (using `SecureRandom` for cryptographically unpredictable boundaries) was implemented by upstream Spring Framework in commit ab2410c754 (author: rstoyanchev@pivotal.io) and was already present in version 5.3.32 when TuxCare onboarded it. The vulnerable pattern (weak Random) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "The target (Spring Framework 5.3.32) is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak `Random`, enabling boundary injection attacks where an attacker could craft input containing valid boundary strings to cause multipart parsers to misinterpret the request structure. The fix (using `SecureRandom` for cryptographically unpredictable boundaries) was implemented by upstream Spring Framework in commit ab2410c754 (author: rstoyanchev@pivotal.io) and was already present in version 5.3.32 when TuxCare onboarded it. The vulnerable pattern (weak Random) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:45:05.549046+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.3.32 is NOT AFFECTED by CVE-2018-15756. The vulnerability (HTTP Range header DoS via excessive ranges) was fixed in upstream Spring Framework and the fix was already present in version 5.3.32 when TuxCare onboarded it. Both required defenses are present: (1) MAX_RANGES=100 limit in parseRanges(), and (2) sum-of-ranges validation in toResourceRegions(). The fix was authored by upstream Spring maintainer Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 423aa28ed584b4ff6e5bad218c09beef5e91951e, which predates the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 5.3.32 is NOT AFFECTED by CVE-2018-15756. The vulnerability (HTTP Range header DoS via excessive ranges) was fixed in upstream Spring Framework and the fix was already present in version 5.3.32 when TuxCare onboarded it. Both required defenses are present: (1) MAX_RANGES=100 limit in parseRanges(), and (2) sum-of-ranges validation in toResourceRegions(). The fix was authored by upstream Spring maintainer Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 423aa28ed584b4ff6e5bad218c09beef5e91951e, which predates the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:57:00.154151+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.32 is NOT affected by CVE-2021-22060 (log injection via malicious input containing newlines and control characters). The fix was already present in the upstream Spring Framework 5.3.32 release that TuxCare onboarded. The core defense (LogFormatUtils replacing newlines with <EOL> and control characters with ?) was implemented in commit 99c7608f by rstoyanchev@vmware.com, and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.32 is NOT affected by CVE-2021-22060 (log injection via malicious input containing newlines and control characters). The fix was already present in the upstream Spring Framework 5.3.32 release that TuxCare onboarded. The core defense (LogFormatUtils replacing newlines with <EOL> and control characters with ?) was implemented in commit 99c7608f by rstoyanchev@vmware.com, and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:40:22.353842+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) is NOT present in Spring Framework 5.3.32-tuxcare.3. The vulnerability allowed attackers to inject additional log entries by embedding newlines and control characters in user-controlled input that was logged without sanitization. The upstream Spring Framework fix was already included in the 5.3.32 release (shipped in v5.3.14+ from D...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) is NOT present in Spring Framework 5.3.32-tuxcare.3. The vulnerability allowed attackers to inject additional log entries by embedding newlines and control characters in user-controlled input that was logged without sanitization. The upstream Spring Framework fix was already included in the 5.3.32 release (shipped in v5.3.14+ from D..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:25:00.091559+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI matching mechanism is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, handler lookup wraps the request and resolves its mapping directly without consulting a cached URI; at :205, CORS lookup uses the same approach, and the class contains neither CachedResult nor the vulnerable URI regex comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI matching mechanism is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, handler lookup wraps the request and resolves its mapping directly without consulting a cached URI; at :205, CORS lookup uses the same approach, and the class contains neither CachedResult nor the vulnerable URI regex comparison."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.32-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.32-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.32-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:21:55.915848+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}