{
  "@id": "urn:uuid:d9036ac8-886e-4e7e-b013-285f455b7258",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 46,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:33:27.361958+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:25:46.380992+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.5 is not affected by CVE-2009-1190. The upstream vendor deprecated HttpInvokerServiceExporter for security reasons (commit d9ccd618ea) with explicit warnings not to expose it to untrusted clients. This deprecation was shipped in upstream release 5.3.5. Additionally, Spring 5.3.5 requires JDK 8+, whereas the CVE affects JDK before 1.6. The combination of vendor deprecation, ...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.5 is not affected by CVE-2009-1190. The upstream vendor deprecated HttpInvokerServiceExporter for security reasons (commit d9ccd618ea) with explicit warnings not to expose it to untrusted clients. This deprecation was shipped in upstream release 5.3.5. Additionally, Spring 5.3.5 requires JDK 8+, whereas the CVE affects JDK before 1.6. The combination of vendor deprecation, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:33:27.361958+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:40:00.094131+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.5 is not affected by CVE-2011-2894. The fix for this deserialization vulnerability (adding the acceptProxyClasses flag to reject malicious proxy class deserialization) was already included in the upstream Spring Framework 5.3.5 release. Commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb, authored by Juergen Hoeller (upstream vendor), is an ancestor of the first TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.5 is not affected by CVE-2011-2894. The fix for this deserialization vulnerability (adding the acceptProxyClasses flag to reject malicious proxy class deserialization) was already included in the upstream Spring Framework 5.3.5 release. Commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb, authored by Juergen Hoeller (upstream vendor), is an ancestor of the first TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 5.3.5. The vulnerability was fixed in the upstream project in May 2014 (commit 8ee465103850a3dca018273fe5952e40d5c45a66), well before the 5.3.5 release in March 2021. The fix adds validation to StringUtils.cleanPath() that rejects path prefixes containing forward slashes, preventing directory traversal attacks via crafted URLs with embedded colon...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 5.3.5. The vulnerability was fixed in the upstream project in May 2014 (commit 8ee465103850a3dca018273fe5952e40d5c45a66), well before the 5.3.5 release in March 2021. The fix adds validation to StringUtils.cleanPath() that rejects path prefixes containing forward slashes, preventing directory traversal attacks via crafted URLs with embedded colon..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:12:22.594906+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client used AlternativeJdkIdGenerator (predictable PRNG seeded once) for session IDs. The target version 5.3.5 uses JdkIdGenerator (UUID.randomUUID(), cryptographically secure) in SockJsUrlInfo.java:39. This fix was introduced by upstream Spring Framework in commit 52b8f344 and was already present in the upstream 5...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client used AlternativeJdkIdGenerator (predictable PRNG seeded once) for session IDs. The target version 5.3.5 uses JdkIdGenerator (UUID.randomUUID(), cryptographically secure) in SockJsUrlInfo.java:39. This fix was introduced by upstream Spring Framework in commit 52b8f344 and was already present in the upstream 5..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:00:16.038874+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.5 is NOT affected by CVE-2015-5211 (Reflected File Download). The RFD protection was added in upstream Spring Framework 4.2.2 (October 2015) via commit 2bd1daa75e by Rossen Stoyanchev (@pivotal.io) and included in all subsequent releases including Spring 5.3.0+. The target contains the complete RFD defense: Content-Disposition header protection in AbstractMessageConverterMethodProcessor.addContentDispositionHeader() with safe extension whitelisting. This is an upstream fix that shipped with the Spring 5.3.5 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.3.5 is NOT affected by CVE-2015-5211 (Reflected File Download). The RFD protection was added in upstream Spring Framework 4.2.2 (October 2015) via commit 2bd1daa75e by Rossen Stoyanchev (@pivotal.io) and included in all subsequent releases including Spring 5.3.0+. The target contains the complete RFD defense: Content-Disposition header protection in AbstractMessageConverterMethodProcessor.addContentDispositionHeader() with safe extension whitelisting. This is an upstream fix that shipped with the Spring 5.3.5 release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:11.896857+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.3.5 is NOT affected by CVE-2016-5007. The vulnerability (pattern matching inconsistencies between Spring Security and Spring MVC leading to authorization bypass) was fixed in upstream Spring Framework 4.3.1+ via the HandlerMappingIntrospector API. This fix shipped with upstream Spring Framework 5.3.0 (June 2020) and is present in 5.3.5. The fix was authored by Rossen Stoyanchev (Spring/Pivotal developer), not TuxCare. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target Spring Framework 5.3.5 is NOT affected by CVE-2016-5007. The vulnerability (pattern matching inconsistencies between Spring Security and Spring MVC leading to authorization bypass) was fixed in upstream Spring Framework 4.3.1+ via the HandlerMappingIntrospector API. This fix shipped with upstream Spring Framework 5.3.0 (June 2020) and is present in 5.3.5. The fix was authored by Rossen Stoyanchev (Spring/Pivotal developer), not TuxCare. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:55:21.996343+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.5 is not affected by CVE-2018-11040. JSONP support was completely removed from Spring Framework 5.1 (June 2018) via commit ac37b678a3, approximately 3 years before the 5.3.5 release. The target codebase contains no JSONP-related code: no jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, and no JSONP transport handlers. The vulnerable code pattern described in the CVE (automatic JSONP wrapping via \"jsonp\"/\"callback\" query parameters) is absent from the entire repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.5 is not affected by CVE-2018-11040. JSONP support was completely removed from Spring Framework 5.1 (June 2018) via commit ac37b678a3, approximately 3 years before the 5.3.5 release. The target codebase contains no JSONP-related code: no jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, and no JSONP transport handlers. The vulnerable code pattern described in the CVE (automatic JSONP wrapping via \"jsonp\"/\"callback\" query parameters) is absent from the entire repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:03:00.096337+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.3.5. The vulnerability involved bypassing security constraints via URL path parameters with special encodings (backslashes, duplicate slashes, percent-encoded traversal sequences). The upstream vendor's fix (SPR-16616) was committed on 2018-03-19 by Rossen Stoyanchev and shipped in the upstream 5.3.5 release before TuxCare onboarding. All requi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.3.5. The vulnerability involved bypassing security constraints via URL path parameters with special encodings (backslashes, duplicate slashes, percent-encoded traversal sequences). The upstream vendor's fix (SPR-16616) was committed on 2018-03-19 by Rossen Stoyanchev and shipped in the upstream 5.3.5 release before TuxCare onboarding. All requi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T09:10:31.335583+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.3.5. The vulnerability involved unguarded Spring EL expression parsing of user-controlled selector headers in STOMP messaging, which could lead to ReDoS attacks. The upstream fix (adding null-check guards and the ability to disable the selector feature) was applied in April 2018 and shipped in the upstream Spring Framework 5.3.5 release that Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.3.5. The vulnerability involved unguarded Spring EL expression parsing of user-controlled selector headers in STOMP messaging, which could lead to ReDoS attacks. The upstream fix (adding null-check guards and the ability to disable the selector feature) was applied in April 2018 and shipped in the upstream Spring Framework 5.3.5 release that Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 but NOT 5.3.5. The vulnerability involved incorrect method resolution on JDK dynamic proxies, allowing method-level security annotations to be bypassed. The upstream fix (commit aa11721ff0, dated 2018-04-27) was already included in Spring Framework v5.3.5 (released 2021-03-16), which TuxCare onboarded. All three key files (AopUtils.java, CacheAspectSupport.java, ApplicationListenerMethodAdapter.java) contain the fixed code patterns that prevent proxy class methods from bypassing security checks. The target version 5.3.5-tuxcare.2 inherited these fixes from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 but NOT 5.3.5. The vulnerability involved incorrect method resolution on JDK dynamic proxies, allowing method-level security annotations to be bypassed. The upstream fix (commit aa11721ff0, dated 2018-04-27) was already included in Spring Framework v5.3.5 (released 2021-03-16), which TuxCare onboarded. All three key files (AopUtils.java, CacheAspectSupport.java, ApplicationListenerMethodAdapter.java) contain the fixed code patterns that prevent proxy class methods from bypassing security checks. The target version 5.3.5-tuxcare.2 inherited these fixes from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:41:00.146678+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.5. The upstream fix (commits 91b803a231 and 0e28bee0f1, issue SPR-16616) was already included in the upstream 5.3.5 release before TuxCare onboarded it. Both servlet (spring-webmvc) and reactive (spring-webflux) resource handlers contain the isInvalidEncodedPath() defense that URL-decodes incoming paths and r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.5. The upstream fix (commits 91b803a231 and 0e28bee0f1, issue SPR-16616) was already included in the upstream 5.3.5 release before TuxCare onboarded it. Both servlet (spring-webmvc) and reactive (spring-webflux) resource handlers contain the isInvalidEncodedPath() defense that URL-decodes incoming paths and r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. The target Spring Framework version 5.3.5 is NOT affected by CVE-2018-1272. The vulnerability involved predictable Random-based boundary generation in multipart requests, allowing attackers to inject malicious multipart parts. The fix (using SecureRandom instead of Random) was already present in the upstream Spring Framework 5.3.5 release, shipped by commit ab2410c754b67902f002bfcc0c3895bd7772d39f (March 2018) before TuxCare's onboarding. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "The target Spring Framework version 5.3.5 is NOT affected by CVE-2018-1272. The vulnerability involved predictable Random-based boundary generation in multipart requests, allowing attackers to inject malicious multipart parts. The fix (using SecureRandom instead of Random) was already present in the upstream Spring Framework 5.3.5 release, shipped by commit ab2410c754b67902f002bfcc0c3895bd7772d39f (March 2018) before TuxCare's onboarding. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:59.528750+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.3.5. The fix was already included in the upstream release v5.3.5 (released 2021-03-16), over 2.5 years after the vulnerability was fixed upstream (2018-10-08). Both required defenses are present: (1) MAX_RANGES=100 limit on line 48 enforced at lines 136-138, and (2) sum-of-ranges validation at lines 185-195 of HttpRange.java. TuxCare onboarded the already-fixed version via commit 580b2d341e.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.3.5. The fix was already included in the upstream release v5.3.5 (released 2021-03-16), over 2.5 years after the vulnerability was fixed upstream (2018-10-08). Both required defenses are present: (1) MAX_RANGES=100 limit on line 48 enforced at lines 136-138, and (2) sum-of-ranges validation at lines 185-195 of HttpRange.java. TuxCare onboarded the already-fixed version via commit 580b2d341e.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:33.092775+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.5-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.5-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:33.092775+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.5-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.5-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:39:22.988337+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:33.092775+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.5-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.5-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:33.092775+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.5-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.5-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.5-tuxcare.3."
    }
  ]
}