{
  "@id": "urn:uuid:f5a869a0-8da5-4fa4-8fb6-fae42291d738",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:27:46.722408+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-10-30T11:54:53.989360+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before version 1.6, which could cause CPU exhaustion when processing regex patterns with multiple optional groups during deserialization. Spring Framework 5.3.39 is not affected because it requires Java 8+ (sourceCompatibility = 1.8), which includes the fix for this JDK-level vulnerabil...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before version 1.6, which could cause CPU exhaustion when processing regex patterns with multiple optional groups during deserialization. Spring Framework 5.3.39 is not affected because it requires Java 8+ (sourceCompatibility = 1.8), which includes the fix for this JDK-level vulnerabil..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-06T17:27:46.722408+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.39 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.39 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-03T09:34:42.871878+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.39 is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes enabling RCE) was fixed by the upstream Spring Framework team in July 2011 for version 3.0.6. The fix (acceptProxyClasses flag with NotSerializableException on rejection) has been part of Spring Framework since then and shipped with the upstream 5.3.39 release that TuxCare onboar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.39 is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes enabling RCE) was fixed by the upstream Spring Framework team in July 2011 for version 3.0.6. The fix (acceptProxyClasses flag with NotSerializableException on rejection) has been part of Spring Framework since then and shipped with the upstream 5.3.39 release that TuxCare onboar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 (directory traversal via crafted URL) is NOT present in Spring Framework 5.3.39. The security fix that prevents fake URI scheme prefixes from bypassing path traversal protections was already included in the upstream Spring Framework 5.3.39 release (commit 8ee465103850a3dca018273fe5952e40d5c45a66 from May 2014). The vulnerable code pattern does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 (directory traversal via crafted URL) is NOT present in Spring Framework 5.3.39. The security fix that prevents fake URI scheme prefixes from bypassing path traversal protections was already included in the upstream Spring Framework 5.3.39 release (commit 8ee465103850a3dca018273fe5952e40d5c45a66 from May 2014). The vulnerable code pattern does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:00.096825+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The target version 5.3.39 is not affected because it already contains the upstream fix (commit 52b8f344) that replaced the vulnerable AlternativeJdkIdGenerator (which used predictable Random after initial SecureRandom seed) with the secure JdkIdGenerator (which uses UUID.rand...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The target version 5.3.39 is not affected because it already contains the upstream fix (commit 52b8f344) that replaced the vulnerable AlternativeJdkIdGenerator (which used predictable Random after initial SecureRandom seed) with the secure JdkIdGenerator (which uses UUID.rand..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-03T12:51:28.138223+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. Spring Framework 5.3.39 is NOT AFFECTED by CVE-2015-5211 (Reflected File Download attack). The vulnerability was fixed in the upstream Spring Framework v4.2.2.RELEASE (October 2015) by commit 2bd1daa75e authored by Rossen Stoyanchev. Since Spring 5.3.39 was released in 2023, it inherently includes this fix from the upstream release. The comprehensive RFD defenses are present and active in the target code, including Content-Disposition header protection for unsafe file extensions, extension whitelisting, and path parameter sanitization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.3.39 is NOT AFFECTED by CVE-2015-5211 (Reflected File Download attack). The vulnerability was fixed in the upstream Spring Framework v4.2.2.RELEASE (October 2015) by commit 2bd1daa75e authored by Rossen Stoyanchev. Since Spring 5.3.39 was released in 2023, it inherently includes this fix from the upstream release. The comprehensive RFD defenses are present and active in the target code, including Content-Disposition header protection for unsafe file extensions, extension whitelisting, and path parameter sanitization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-03T13:03:12.649222+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. CVE-2016-5007 addresses inconsistent URL pattern matching between Spring Security and Spring MVC that could allow authorization bypass via path variations (e.g., spaces in path segments). The fix introduces HandlerMappingIntrospector API in Spring Framework 4.3.1 to enable Spring Security to use the same pattern matching logic as MVC. The target (Spring Framework 5.3.39-tuxcare.23) contains this fix from the upstream release - commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by rstoyanchev@pivotal.io is present in v5.3.39 and predates all TuxCare commits. All fix components (HandlerMappingIntrospector, MatchableHandlerMapping interface, match() implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping) are properly implemented. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses inconsistent URL pattern matching between Spring Security and Spring MVC that could allow authorization bypass via path variations (e.g., spaces in path segments). The fix introduces HandlerMappingIntrospector API in Spring Framework 4.3.1 to enable Spring Security to use the same pattern matching logic as MVC. The target (Spring Framework 5.3.39-tuxcare.23) contains this fix from the upstream release - commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by rstoyanchev@pivotal.io is present in v5.3.39 and predates all TuxCare commits. All fix components (HandlerMappingIntrospector, MatchableHandlerMapping interface, match() implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping) are properly implemented. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:02.040973+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework versions with automatic JSONP support enabled by default in MappingJackson2JsonView. The target version 5.3.39 is NOT affected because all JSONP functionality was completely removed by upstream Spring Framework commit ac37b678a3 (dated 2018-06-07, author sdeleuze@pivotal.io). This removal occurred before TuxCare onboarded the release. The vulnerable code patterns (MappingJackson2JsonView.jsonpParameterNames field with default values \"jsonp\" and \"callback\", AbstractJsonpResponseBodyAdvice class, and all JSONP transport handlers) do not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework versions with automatic JSONP support enabled by default in MappingJackson2JsonView. The target version 5.3.39 is NOT affected because all JSONP functionality was completely removed by upstream Spring Framework commit ac37b678a3 (dated 2018-06-07, author sdeleuze@pivotal.io). This removal occurred before TuxCare onboarded the release. The vulnerable code patterns (MappingJackson2JsonView.jsonpParameterNames field with default values \"jsonp\" and \"callback\", AbstractJsonpResponseBodyAdvice class, and all JSONP transport handlers) do not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-03T00:50:03.356713+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 5.3.39. The upstream fix (commit 0e28bee0f155b9bf240b4bafc4646e4810cb23f8 \"Clean duplicate separators in resource URLs\" by rstoyanchev@pivotal.io) shipped in the upstream Spring Framework 5.3.39 release that TuxCare used as their base. The fix prevents path traversal via encoded separators by: (1) normalizing backslashes to forward slashes, (2) r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 5.3.39. The upstream fix (commit 0e28bee0f155b9bf240b4bafc4646e4810cb23f8 \"Clean duplicate separators in resource URLs\" by rstoyanchev@pivotal.io) shipped in the upstream Spring Framework 5.3.39 release that TuxCare used as their base. The fix prevents path traversal via encoded separators by: (1) normalizing backslashes to forward slashes, (2) r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-10-30T08:47:11.256466+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17 through a ReDoS vulnerability in STOMP selector expression parsing. The target (5.3.39) is not affected because the upstream fix (commit ff2228fdaf from April 2018) was already present in the Spring Framework 5.1.0+ release line, which predates version 5.3.39. The fix adds a null check before parsing ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17 through a ReDoS vulnerability in STOMP selector expression parsing. The target (5.3.39) is not affected because the upstream fix (commit ff2228fdaf from April 2018) was already present in the Spring Framework 5.1.0+ release line, which predates version 5.3.39. The fix adds a null check before parsing ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. The target Spring Framework 5.3.39 is NOT affected by CVE-2018-1258. The vulnerability involved improper method resolution for JDK dynamic proxy classes that could bypass Spring Security method-level annotations. The upstream vendor fix (commits aa11721ff0 and eaff2c28a7 by Juergen Hoeller from Pivotal) was already included in Spring Framework 5.1.0.RC1 (October 2018) and is present in this 5.3.39 release. All fix code is verified in the target: AopUtils.getMostSpecificMethod properly processes proxy classes, AnnotationMethodMatcher has the proxy early-exit check, and both CacheAspectSupport and ApplicationListenerMethodAdapter pre-resolve target methods correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "The target Spring Framework 5.3.39 is NOT affected by CVE-2018-1258. The vulnerability involved improper method resolution for JDK dynamic proxy classes that could bypass Spring Security method-level annotations. The upstream vendor fix (commits aa11721ff0 and eaff2c28a7 by Juergen Hoeller from Pivotal) was already included in Spring Framework 5.1.0.RC1 (October 2018) and is present in this 5.3.39 release. All fix code is verified in the target: AopUtils.getMostSpecificMethod properly processes proxy classes, AnnotationMethodMatcher has the proxy early-exit check, and both CacheAspectSupport and ApplicationListenerMethodAdapter pre-resolve target methods correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-10-30T18:15:01.892768+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is not present in Spring Framework 5.3.39. The upstream fix that checks for both forward-slash (../) and backslash (..\\) directory traversal patterns was already present in the Spring Framework 5.3.x release that TuxCare onboarded. The fix commit f59ea610dfcf55cd0b42f6dd76a9b3dab0218aaa by upstream maintainer Juergen Hoeller (jhoeller@pivotal.io) ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is not present in Spring Framework 5.3.39. The upstream fix that checks for both forward-slash (../) and backslash (..\\) directory traversal patterns was already present in the Spring Framework 5.3.x release that TuxCare onboarded. The fix commit f59ea610dfcf55cd0b42f6dd76a9b3dab0218aaa by upstream maintainer Juergen Hoeller (jhoeller@pivotal.io) ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. CVE-2018-1272 is not present in Spring Framework 5.3.39. The vulnerability involved predictable multipart boundary generation using non-cryptographic Random, allowing attackers to inject malicious multipart parts. The upstream vendor fixed this in March 2018 (commit ab2410c754b67902f002bfcc0c3895bd7772d39f) by replacing Random with SecureRandom. This fix was already present in the upstream 5.3.39 release when TuxCare onboarded it. The current code at line 393 of MimeTypeUtils.java uses 'new SecureRandom()' via lazy initialization, making boundary prediction infeasible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is not present in Spring Framework 5.3.39. The vulnerability involved predictable multipart boundary generation using non-cryptographic Random, allowing attackers to inject malicious multipart parts. The upstream vendor fixed this in March 2018 (commit ab2410c754b67902f002bfcc0c3895bd7772d39f) by replacing Random with SecureRandom. This fix was already present in the upstream 5.3.39 release when TuxCare onboarded it. The current code at line 393 of MimeTypeUtils.java uses 'new SecureRandom()' via lazy initialization, making boundary prediction infeasible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-03T13:29:29.992370+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.3.39-tuxcare.23. The fix was already included in the upstream Spring Framework 5.3.x release before TuxCare began maintaining this version. Both required defenses are present: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges (HttpRange.java:136-138), and (2) validation ensuring sum of all range lengths < resource length (HttpRange.java:185-195). Fix commit 423aa28ed5 by rstoyanchev@vmware.com (2018-10-03) is an ancestor of HEAD and predates the first TuxCare commit (4ce9b2688e). The vulnerable pattern (unbounded range processing allowing DoS via resource exhaustion) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.3.39-tuxcare.23. The fix was already included in the upstream Spring Framework 5.3.x release before TuxCare began maintaining this version. Both required defenses are present: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges (HttpRange.java:136-138), and (2) validation ensuring sum of all range lengths < resource length (HttpRange.java:185-195). Fix commit 423aa28ed5 by rstoyanchev@vmware.com (2018-10-03) is an ancestor of HEAD and predates the first TuxCare commit (4ce9b2688e). The vulnerable pattern (unbounded range processing allowing DoS via resource exhaustion) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-10-31T20:04:00.153784+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection via newlines/control characters) is not present in Spring Framework 5.3.39-tuxcare.23. The vulnerability was fixed in upstream Spring Framework 5.3.14 (released 2021-12-21) before the 5.3.39 release. The fix sanitizes user input before logging by replacing newlines with &lt;EOL&gt; and control characters with ? using LogFormatUtils.formatValue(). This fix was alrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection via newlines/control characters) is not present in Spring Framework 5.3.39-tuxcare.23. The vulnerability was fixed in upstream Spring Framework 5.3.14 (released 2021-12-21) before the 5.3.39 release. The fix sanitizes user input before logging by replacing newlines with &lt;EOL&gt; and control characters with ? using LogFormatUtils.formatValue(). This fix was alrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-10-31T21:10:00.324150+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 affects Spring Framework 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. The target version 5.3.39 is not affected because the upstream fix (commit 99c7608ffe by Rossen Stoyanchev) was already included in the upstream Spring Framework 5.3.39 release before TuxCare onboarding. The fix sanitizes user-controlled input before logging by replacing newline characters with <EOL> and con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 affects Spring Framework 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. The target version 5.3.39 is not affected because the upstream fix (commit 99c7608ffe by Rossen Stoyanchev) was already included in the upstream Spring Framework 5.3.39 release before TuxCare onboarding. The fix sanitizes user-controlled input before logging by replacing newline characters with <EOL> and con..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.3.39-tuxcare.21 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}