{
  "@id": "urn:uuid:e41720ec-8ede-4146-aeae-cef0dd64a512",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 52,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:22:46.193289+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-30T12:14:47.906597+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.37 is not affected by CVE-2009-1190. While the code pattern exists (JdkRegexpMethodPointcut is Serializable and calls Pattern.compile without validation), the vulnerability requires JDK before 1.6. The target requires Java 8+ (JDK 1.8+) as confirmed in gradle/toolchains.gradle, which includes fixes for the regex algorithmic complexity vulnerability. The ambient JDK-level de...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.37 is not affected by CVE-2009-1190. While the code pattern exists (JdkRegexpMethodPointcut is Serializable and calls Pattern.compile without validation), the vulnerability requires JDK before 1.6. The target requires Java 8+ (JDK 1.8+) as confirmed in gradle/toolchains.gradle, which includes fixes for the regex algorithmic complexity vulnerability. The ambient JDK-level de..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-06T17:31:17.527478+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.37 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.37 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T09:37:00.071610+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.37-tuxcare.13 is not affected by CVE-2011-2894. The vulnerability affected Spring Framework 3.0.0-3.0.5, which lacked protection against malicious proxy deserialization. The upstream fix was applied in July 2011 (commit 7d8aa05c407 by jhoeller@vmware.com) and shipped with the Spring Framework 5.3.37 upstream release that TuxCare onboarded. The fix adds an acceptProxyClasses...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.37-tuxcare.13 is not affected by CVE-2011-2894. The vulnerability affected Spring Framework 3.0.0-3.0.5, which lacked protection against malicious proxy deserialization. The upstream fix was applied in July 2011 (commit 7d8aa05c407 by jhoeller@vmware.com) and shipped with the Spring Framework 5.3.37 upstream release that TuxCare onboarded. The fix adds an acceptProxyClasses..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.3.37-tuxcare.13. The fix was already included in the upstream Spring Framework 5.3.37 release before TuxCare onboarded it. The vulnerability involved StringUtils.cleanPath() mishandling path prefixes containing colons and slashes, allowing directory traversal via crafted URLs like \"/a/:b/../../file\". The fix (c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.3.37-tuxcare.13. The fix was already included in the upstream Spring Framework 5.3.37 release before TuxCare onboarded it. The vulnerability involved StringUtils.cleanPath() mishandling path prefixes containing colons and slashes, allowing directory traversal via crafted URLs like \"/a/:b/../../file\". The fix (c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:46.375124+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.37 is not affected by CVE-2015-0201. The vulnerability (predictable session IDs in SockJS client) was fixed in upstream Spring Framework 4.1.5 (January 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator. The target version 5.3.37 includes this fix from the upstream release. Current code uses UUID.randomUUID() for cryptographically secure session ID generation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.37 is not affected by CVE-2015-0201. The vulnerability (predictable session IDs in SockJS client) was fixed in upstream Spring Framework 4.1.5 (January 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator. The target version 5.3.37 includes this fix from the upstream release. Current code uses UUID.randomUUID() for cryptographically secure session ID generation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T12:58:17.463230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download / RFD) is NOT present in Spring Framework 5.3.37-tuxcare.13. The upstream fix commit 2bd1daa75e (\"Protect against RFD exploits\") by Rossen Stoyanchev (Pivotal/Spring team) was released in Spring v4.2.2.RELEASE (October 2015) and is present in the upstream v5.3.37 release that TuxCare onboarded. The fix adds Content-Disposition headers with safe filenames when unsafe extensions (like .bat, .cmd, .exe) are detected in URLs including path parameters, preventing browsers from downloading responses with attacker-controlled dangerous file extensions. The defense code is fully implemented in AbstractMessageConverterMethodProcessor.java with SAFE_EXTENSIONS whitelist and addContentDispositionHeader() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download / RFD) is NOT present in Spring Framework 5.3.37-tuxcare.13. The upstream fix commit 2bd1daa75e (\"Protect against RFD exploits\") by Rossen Stoyanchev (Pivotal/Spring team) was released in Spring v4.2.2.RELEASE (October 2015) and is present in the upstream v5.3.37 release that TuxCare onboarded. The fix adds Content-Disposition headers with safe filenames when unsafe extensions (like .bat, .cmd, .exe) are detected in URLs including path parameters, preventing browsers from downloading responses with attacker-controlled dangerous file extensions. The defense code is fully implemented in AbstractMessageConverterMethodProcessor.java with SAFE_EXTENSIONS whitelist and addContentDispositionHeader() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. Spring Framework 5.3.37 is not affected by CVE-2016-5007. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev) was already included in the Spring Framework 5.3.37 release that TuxCare onboarded. The fix introduces HandlerMappingIntrospector API, MatchableHandlerMapping interface, and RequestMatchResult class to provide Spring Security with a unified URL pattern matching API that uses the same logic as Spring MVC, preventing authorization bypass due to pattern matching inconsistencies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.3.37 is not affected by CVE-2016-5007. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev) was already included in the Spring Framework 5.3.37 release that TuxCare onboarded. The fix introduces HandlerMappingIntrospector API, MatchableHandlerMapping interface, and RequestMatchResult class to provide Spring Security with a unified URL pattern matching API that uses the same logic as Spring MVC, preventing authorization bypass due to pattern matching inconsistencies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T13:52:54.438603+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. Spring Framework 5.3.37 is not affected by CVE-2018-11040. The vulnerable JSONP (JSON with Padding) functionality was completely removed from Spring Framework starting in version 5.1.0 (June 2018, commit ac37b678a3) as part of the upstream project's migration to CORS for cross-domain requests. The target version 5.3.37 never contained the vulnerable code pattern, as the removal was part of the upstream release that TuxCare onboarded. The CVE affected versions 4.3.x < 4.3.18 and 5.0.x < 5.0.7, where JSONP was enabled by default; version 5.3.37 is a much later release where JSONP does not exist at all.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.37 is not affected by CVE-2018-11040. The vulnerable JSONP (JSON with Padding) functionality was completely removed from Spring Framework starting in version 5.1.0 (June 2018, commit ac37b678a3) as part of the upstream project's migration to CORS for cross-domain requests. The target version 5.3.37 never contained the vulnerable code pattern, as the removal was part of the upstream release that TuxCare onboarded. The CVE affected versions 4.3.x < 4.3.18 and 5.0.x < 5.0.7, where JSONP was enabled by default; version 5.3.37 is a much later release where JSONP does not exist at all.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T00:56:22.909862+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.37 is NOT AFFECTED by CVE-2018-1199. All upstream security fixes for path normalization and validation were already present in the upstream Spring Framework 5.3.37 release before TuxCare onboarded it. The vulnerable patterns (unnormalized paths with duplicate slashes, backslashes, or encoded traversal sequences bypassing security constraints) have been eliminated by compreh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.37 is NOT AFFECTED by CVE-2018-1199. All upstream security fixes for path normalization and validation were already present in the upstream Spring Framework 5.3.37 release before TuxCare onboarded it. The vulnerable patterns (unnormalized paths with duplicate slashes, backslashes, or encoded traversal sequences bypassing security constraints) have been eliminated by compreh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-30T09:05:51.109874+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.37 includes the upstream fix for CVE-2018-1257 that was introduced in Spring Framework 4.3.17 and 5.0.6. The fix adds configuration capability to disable STOMP selector header processing by setting the selector header name to null, which prevents parsing of untrusted Spring EL expressions that could cause ReDoS attacks. While selector processing is enabled by def...",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.37 includes the upstream fix for CVE-2018-1257 that was introduced in Spring Framework 4.3.17 and 5.0.6. The fix adds configuration capability to disable STOMP selector header processing by setting the selector header name to null, which prevents parsing of untrusted Spring EL expressions that could cause ReDoS attacks. While selector processing is enabled by def..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. CVE-2018-1258 describes an authorization bypass in Spring Framework 5.0.5 when using method security with JDK dynamic proxies. The vulnerability occurred because the framework incorrectly resolved target methods on proxy instances, checking the proxy's redeclared method (without annotations) instead of the actual implementation method (with security annotations). The upstream fixes (commits aa11721ff0 and eaff2c28a7, both dated April 27, 2018 by jhoeller@pivotal.io) were already included in Spring Framework 5.3.37 before TuxCare onboarded this version on October 30, 2025. All three critical components of the fix are present in the target code: (1) AopUtils.getMostSpecificMethod correctly handles proxy classes, (2) AnnotationMethodMatcher returns false early for proxy classes, and (3) CacheAspectSupport/ApplicationListenerMethodAdapter properly resolve target methods. The target is not affected because the vulnerable code pattern was already removed by the upstream vendor before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 describes an authorization bypass in Spring Framework 5.0.5 when using method security with JDK dynamic proxies. The vulnerability occurred because the framework incorrectly resolved target methods on proxy instances, checking the proxy's redeclared method (without annotations) instead of the actual implementation method (with security annotations). The upstream fixes (commits aa11721ff0 and eaff2c28a7, both dated April 27, 2018 by jhoeller@pivotal.io) were already included in Spring Framework 5.3.37 before TuxCare onboarded this version on October 30, 2025. All three critical components of the fix are present in the target code: (1) AopUtils.getMostSpecificMethod correctly handles proxy classes, (2) AnnotationMethodMatcher returns false early for proxy classes, and (3) CacheAspectSupport/ApplicationListenerMethodAdapter properly resolve target methods. The target is not affected because the vulnerable code pattern was already removed by the upstream vendor before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-30T18:31:56.926996+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 Target version 5.3.37 is not affected by CVE-2018-1271. The directory traversal vulnerability was fixed by the upstream Spring Framework team in March 2018 (versions 5.0.5 and 4.3.15). All fix commits (0e28bee0, 91b803a2, 13356a7, 98ad23b, 695bf29, f59ea61) are present in HEAD and were part of the upstream 5.3.37 release that TuxCare onboarded. The defense code isInvalidEncodedPath() is present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Target version 5.3.37 is not affected by CVE-2018-1271. The directory traversal vulnerability was fixed by the upstream Spring Framework team in March 2018 (versions 5.0.5 and 4.3.15). All fix commits (0e28bee0, 91b803a2, 13356a7, 98ad23b, 695bf29, f59ea61) are present in HEAD and were part of the upstream 5.3.37 release that TuxCare onboarded. The defense code isInvalidEncodedPath() is present..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T12:20:19.402749+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework versions with predictable multipart boundary generation using weak java.util.Random. The target version 5.3.37-tuxcare.13 is NOT affected because the upstream fix (commit ab2410c754) that replaced Random with SecureRandom was already present in the upstream 5.3.37 release before TuxCare onboarding. The vulnerable pattern (weak Random for boundary generation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework versions with predictable multipart boundary generation using weak java.util.Random. The target version 5.3.37-tuxcare.13 is NOT affected because the upstream fix (commit ab2410c754) that replaced Random with SecureRandom was already present in the upstream 5.3.37 release before TuxCare onboarding. The vulnerable pattern (weak Random for boundary generation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T13:33:56.225785+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. CVE-2018-15756 is not present in Spring Framework 5.3.37. The vulnerability involved denial of service through HTTP Range headers with excessive ranges or overlapping wide ranges. The fix was shipped in the upstream release that TuxCare onboarded, implementing two defenses: (1) a MAX_RANGES limit of 100 in parseRanges(), and (2) validation that the sum of all requested byte ranges does not equal or exceed the resource length in toResourceRegions(). Both protections are present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is not present in Spring Framework 5.3.37. The vulnerability involved denial of service through HTTP Range headers with excessive ranges or overlapping wide ranges. The fix was shipped in the upstream release that TuxCare onboarded, implementing two defenses: (1) a MAX_RANGES limit of 100 in parseRanges(), and (2) validation that the sum of all requested byte ranges does not equal or exceed the resource length in toResourceRegions(). Both protections are present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-31T20:21:00.159951+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection vulnerability) is NOT present in Spring Framework 5.3.37-tuxcare.13. The upstream vendor (Spring/VMware) fixed this vulnerability in commits 99c7608f (core LogFormatUtils fix) and e9083d7d (application to logging sites) authored by rstoyanchev@vmware.com. Both commits were already included in the upstream 5.3.37 release that TuxCare onboarded (commit e2dd12f4), mea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection vulnerability) is NOT present in Spring Framework 5.3.37-tuxcare.13. The upstream vendor (Spring/VMware) fixed this vulnerability in commits 99c7608f (core LogFormatUtils fix) and e9083d7d (application to logging sites) authored by rstoyanchev@vmware.com. Both commits were already included in the upstream 5.3.37 release that TuxCare onboarded (commit e2dd12f4), mea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-31T21:20:46.030560+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.37 is NOT AFFECTED by CVE-2021-22096 (log injection vulnerability). The vulnerability pattern - unfiltered user-controlled input in log statements - is not present in the target because it was removed by upstream Spring Framework fixes (commits 99c7608f and e9083d7d) that shipped with the upstream 5.3.37 release. These upstream commits added LogFormatUtils saniti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.37 is NOT AFFECTED by CVE-2021-22096 (log injection vulnerability). The vulnerability pattern - unfiltered user-controlled input in log statements - is not present in the target because it was removed by upstream Spring Framework fixes (commits 99c7608f and e9083d7d) that shipped with the upstream 5.3.37 release. These upstream commits added LogFormatUtils saniti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI regular expression comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:221, the shared lookup implementation iterates over handler mappings and restores the parsed path without the vulnerable cached-URI comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI regular expression comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:221, the shared lookup implementation iterates over handler mappings and restores the parsed path without the vulnerable cached-URI comparison."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}