{
  "@id": "urn:uuid:22d66604-e3f4-48ab-9950-a290229f5d93",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 52,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:25:00.091559+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T13:00:26.830408+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2009-1190. The vulnerability requires deserializing untrusted data containing malicious regex patterns, which triggers CPU exhaustion via Pattern.compile(). The upstream vendor (Spring) mitigated this by deprecating all serialization-based remoting (HttpInvoker, RMI) in Spring 5.3.0 (July 2020) with explicit warnings against exposing these endpoint...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2009-1190. The vulnerability requires deserializing untrusted data containing malicious regex patterns, which triggers CPU exhaustion via Pattern.compile(). The upstream vendor (Spring) mitigated this by deprecating all serialization-based remoting (HttpInvoker, RMI) in Spring 5.3.0 (July 2020) with explicit warnings against exposing these endpoint..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:25.193904+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.33 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.33 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:52:00.073904+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 does not affect Spring Framework 5.3.33. The vulnerability (unrestricted deserialization of Java proxy classes leading to arbitrary code execution) was fixed by the upstream Spring Framework project in July 2011 via commit 7d8aa05c. This fix added an 'acceptProxyClasses' configuration flag that allows blocking proxy class deserialization, with validation enforced in ConfigurableOb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 does not affect Spring Framework 5.3.33. The vulnerability (unrestricted deserialization of Java proxy classes leading to arbitrary code execution) was fixed by the upstream Spring Framework project in July 2011 via commit 7d8aa05c. This fix added an 'acceptProxyClasses' configuration flag that allows blocking proxy class deserialization, with validation enforced in ConfigurableOb..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in StringUtils.cleanPath() affecting Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target version 5.3.33 is not affected because the fix was already included in the upstream release. The vulnerable code pattern (improper prefix extraction before colon allowing path traversal bypass) is not present in the target. The fix logic at...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in StringUtils.cleanPath() affecting Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target version 5.3.33 is not affected because the fix was already included in the upstream release. The vulnerable code pattern (improper prefix extraction before colon allowing path traversal bypass) is not present in the target. The fix logic at..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:19:36.318385+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The vulnerability used AlternativeJdkIdGenerator which relies on java.util.Random (predictable after initial seed). The target version 5.3.33 uses JdkIdGenerator which calls UUID.randomUUID() for cryptographically secure session IDs. The fix was shipped in the upstream releas...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The vulnerability used AlternativeJdkIdGenerator which relies on java.util.Random (predictable after initial seed). The target version 5.3.33 uses JdkIdGenerator which calls UUID.randomUUID() for cryptographically secure session IDs. The fix was shipped in the upstream releas..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.3.33 is NOT vulnerable to CVE-2015-5211 (Reflected File Download attack). The upstream fix was already present in the Spring Framework 5.3.33 release that TuxCare onboarded. The fix commit (2bd1daa75e) from October 2015 is an ancestor of HEAD and predates the TuxCare onboarding commit by 10,887 commits. The key RFD protection mechanism (Content-Disposition header injection for unsafe file extensions) is present and active in AbstractMessageConverterMethodProcessor.addContentDispositionHeader().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "The target Spring Framework 5.3.33 is NOT vulnerable to CVE-2015-5211 (Reflected File Download attack). The upstream fix was already present in the Spring Framework 5.3.33 release that TuxCare onboarded. The fix commit (2bd1daa75e) from October 2015 is an ancestor of HEAD and predates the TuxCare onboarding commit by 10,887 commits. The key RFD protection mechanism (Content-Disposition header injection for unsafe file extensions) is present and active in AbstractMessageConverterMethodProcessor.addContentDispositionHeader().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:18:44.496921+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 5.3.33. The vulnerability concerned URL pattern-matching inconsistencies between Spring Security and Spring MVC that could allow authorization bypass. The fix (HandlerMapping introspection API including MatchableHandlerMapping interface, HandlerMappingIntrospector, RequestMatchResult, and match() implementations) is present in the target at HEAD. This fix was introduced by upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 (authored by rstoyanchev@pivotal.io) which is an ancestor of the first TuxCare commit (Onboard version 5.3.33). The fix shipped in the upstream Spring Framework 5.3.33 release, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 5.3.33. The vulnerability concerned URL pattern-matching inconsistencies between Spring Security and Spring MVC that could allow authorization bypass. The fix (HandlerMapping introspection API including MatchableHandlerMapping interface, HandlerMappingIntrospector, RequestMatchResult, and match() implementations) is present in the target at HEAD. This fix was introduced by upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 (authored by rstoyanchev@pivotal.io) which is an ancestor of the first TuxCare commit (Onboard version 5.3.33). The fix shipped in the upstream Spring Framework 5.3.33 release, not as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:13.058306+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.3.33 is NOT AFFECTED by CVE-2018-11040. JSONP support was completely removed from the codebase in upstream commit ac37b678a3 (June 2018) by Sebastien Deleuze, well before the 5.3.33 release. All JSONP-related files (AbstractJsonpResponseBodyAdvice.java, JsonpPollingTransportHandler.java, JsonpReceivingTransportHandler.java) and code (jsonpParameterNames field, setJsonpParameterNames method, JSONP wrapping logic) have been deleted. The vulnerability pattern - automatic JSONP parameter recognition via \"jsonp\" or \"callback\" query parameters - does not exist in the target. This was an upstream fix shipped in the base 5.3.33 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target Spring Framework 5.3.33 is NOT AFFECTED by CVE-2018-11040. JSONP support was completely removed from the codebase in upstream commit ac37b678a3 (June 2018) by Sebastien Deleuze, well before the 5.3.33 release. All JSONP-related files (AbstractJsonpResponseBodyAdvice.java, JsonpPollingTransportHandler.java, JsonpReceivingTransportHandler.java) and code (jsonpParameterNames field, setJsonpParameterNames method, JSONP wrapping logic) have been deleted. The vulnerability pattern - automatic JSONP parameter recognition via \"jsonp\" or \"callback\" query parameters - does not exist in the target. This was an upstream fix shipped in the base 5.3.33 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:14:00.204394+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 5.3.33-tuxcare.4. The vulnerability (URL path parameter bypass via duplicate slashes/backslashes) was fixed in upstream commit 0e28bee0f1 (\"Clean duplicate separators in resource URLs\") which shipped in the Spring Framework 5.3.33 release before TuxCare onboarded it. The target code contains the complete defense: ResourceHttpRequestHandler.proces...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 5.3.33-tuxcare.4. The vulnerability (URL path parameter bypass via duplicate slashes/backslashes) was fixed in upstream commit 0e28bee0f1 (\"Clean duplicate separators in resource URLs\") which shipped in the Spring Framework 5.3.33 release before TuxCare onboarded it. The target code contains the complete defense: ResourceHttpRequestHandler.proces..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.33 is NOT vulnerable to CVE-2018-1257. The vulnerability allowed attackers to craft STOMP subscription messages with malicious \"selector\" headers containing Spring EL expressions that caused ReDoS during parsing. The fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 2018) was already present in the upstream Spring Framework 5.3.33 release that TuxCare onboa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.33 is NOT vulnerable to CVE-2018-1257. The vulnerability allowed attackers to craft STOMP subscription messages with malicious \"selector\" headers containing Spring EL expressions that caused ReDoS during parsing. The fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 2018) was already present in the upstream Spring Framework 5.3.33 release that TuxCare onboa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.33 is not affected by CVE-2018-1258. The vulnerability involved incorrect method resolution for JDK dynamic proxies, causing Spring Security method-level security annotations to be bypassed. The fixes were committed upstream by Juergen Hoeller (jhoeller@pivotal.io) on April 27, 2018, in commits aa11721ff0 and eaff2c28a7. Both commits are ancestors of the first TuxCare onboarding commit (0436f56340a from Sept 2026), confirming the fixes shipped with the upstream Spring Framework 5.3.33 release. Code inspection of AopUtils.java, AnnotationMethodMatcher.java, CacheAspectSupport.java, and ApplicationListenerMethodAdapter.java confirms all fix patterns are present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.3.33 is not affected by CVE-2018-1258. The vulnerability involved incorrect method resolution for JDK dynamic proxies, causing Spring Security method-level security annotations to be bypassed. The fixes were committed upstream by Juergen Hoeller (jhoeller@pivotal.io) on April 27, 2018, in commits aa11721ff0 and eaff2c28a7. Both commits are ancestors of the first TuxCare onboarding commit (0436f56340a from Sept 2026), confirming the fixes shipped with the upstream Spring Framework 5.3.33 release. Code inspection of AopUtils.java, AnnotationMethodMatcher.java, CacheAspectSupport.java, and ApplicationListenerMethodAdapter.java confirms all fix patterns are present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:09:00.107947+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.33. The upstream fix (commit 0e28bee0f1 by Rossen Stoyanchev) was already included in the upstream 5.3.33 release before TuxCare onboarded it. The target contains complete defense mechanisms: processPath() normalizes backslashes to forward slashes and removes duplicate slashes; isInvalidEncodedPath() URL-deco...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.33. The upstream fix (commit 0e28bee0f1 by Rossen Stoyanchev) was already included in the upstream 5.3.33 release before TuxCare onboarded it. The target contains complete defense mechanisms: processPath() normalizes backslashes to forward slashes and removes duplicate slashes; isInvalidEncodedPath() URL-deco..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:33:19.742472+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.33 is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary strings generated using weak java.util.Random, allowing attackers to inject additional multipart parts. The target uses SecureRandom for boundary generation (MimeTypeUtils.java lines 387-399), making boundaries cryptographically unpredictable. This fix was introduced by upstream commit 847202c8f8e (Juergen Hoeller, 2018-06-25) and was already present in the upstream 5.3.33 release that TuxCare onboarded. The CVE affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15; version 5.3.33 is much newer and includes the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 5.3.33 is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary strings generated using weak java.util.Random, allowing attackers to inject additional multipart parts. The target uses SecureRandom for boundary generation (MimeTypeUtils.java lines 387-399), making boundaries cryptographically unpredictable. This fix was introduced by upstream commit 847202c8f8e (Juergen Hoeller, 2018-06-25) and was already present in the upstream 5.3.33 release that TuxCare onboarded. The CVE affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15; version 5.3.33 is much newer and includes the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:45:27.906732+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.3.33 is NOT affected by CVE-2018-15756. The vulnerability (DoS via excessive HTTP Range headers) was fixed by upstream Spring in October 2018 (commit 423aa28ed5), over 5 years before the 5.3.33 release (March 2024). The target code contains all three defenses from the vendor patch: MAX_RANGES=100 limit, range count validation in parseRanges(), and overlapping-range sum validation in toResourceRegions(). This is an upstream vendor fix that shipped with the 5.3.33 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 5.3.33 is NOT affected by CVE-2018-15756. The vulnerability (DoS via excessive HTTP Range headers) was fixed by upstream Spring in October 2018 (commit 423aa28ed5), over 5 years before the 5.3.33 release (March 2024). The target code contains all three defenses from the vendor patch: MAX_RANGES=100 limit, range count validation in parseRanges(), and overlapping-range sum validation in toResourceRegions(). This is an upstream vendor fix that shipped with the 5.3.33 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:58:32.808259+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2021-22060. The upstream fix was already included in Spring Framework 5.3.14 (released December 2021), well before version 5.3.33. The fix adds comprehensive log injection protection by sanitizing newline characters (replacing with &lt;EOL&gt;) and control characters (replacing with ?) in LogFormatUtils.formatValue(), and applies this sanitization ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2021-22060. The upstream fix was already included in Spring Framework 5.3.14 (released December 2021), well before version 5.3.33. The fix adds comprehensive log injection protection by sanitizing newline characters (replacing with &lt;EOL&gt;) and control characters (replacing with ?) in LogFormatUtils.formatValue(), and applies this sanitization ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:40:58.163080+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.33. The vulnerability affects versions 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. Target version 5.3.33 already contains the upstream vendor fix (commit 99c7608f by rstoyanchev@vmware.com) that sanitizes newlines and control characters in logged user input via LogFormatUtils. The fix was sh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.33. The vulnerability affects versions 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. Target version 5.3.33 already contains the upstream vendor fix (commit 99c7608f by rstoyanchev@vmware.com) that sanitizes newlines and control characters in logged user input via LogFormatUtils. The fix was sh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:25:00.091559+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-result code that evaluates request URIs as regular expressions is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, getMatchableHandlerMapping performs a direct handler lookup without a cached-result comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-result code that evaluates request URIs as regular expressions is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, getMatchableHandlerMapping performs a direct handler lookup without a cached-result comparison."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T15:06:00.746750+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.33-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T15:06:00.746750+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.33-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}