{
  "@id": "urn:uuid:e501683e-b15b-4267-b764-cbe007d01b01",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 49,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T23:47:00.103733+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:24:00.113063+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is a JDK vulnerability in Pattern.compile affecting Java versions before 1.6. Spring Framework 5.3.6 requires Java 8+ as its minimum runtime environment (per gradle/toolchains.gradle), which includes the fix introduced in Java 6. While the framework uses Pattern.compile in multiple locations (UriTemplate, PatternEditor, JdkRegexpMethodPointcut), exploitation cannot occur because t...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is a JDK vulnerability in Pattern.compile affecting Java versions before 1.6. Spring Framework 5.3.6 requires Java 8+ as its minimum runtime environment (per gradle/toolchains.gradle), which includes the fix introduced in Java 6. While the framework uses Pattern.compile in multiple locations (UriTemplate, PatternEditor, JdkRegexpMethodPointcut), exploitation cannot occur because t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:33:27.361958+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:43:00.134280+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.6 is not affected by CVE-2011-2894. The vulnerability affected versions 3.0.0 through 3.0.5. An upstream fix was applied by Juergen Hoeller (VMware) in July 2011 (commit 7d8aa05c40), which added the acceptProxyClasses flag and defense mechanism to ConfigurableObjectInputStream. This fix was already present in Spring 5.3.6 when released in 2021. Additionally, the entire seri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.6 is not affected by CVE-2011-2894. The vulnerability affected versions 3.0.0 through 3.0.5. An upstream fix was applied by Juergen Hoeller (VMware) in July 2011 (commit 7d8aa05c40), which added the acceptProxyClasses flag and defense mechanism to ConfigurableObjectInputStream. This fix was already present in Spring 5.3.6 when released in 2021. Additionally, the entire seri..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in Spring Framework 5.3.6. The vulnerability allowed attackers to read arbitrary files via crafted URLs with path prefixes containing forward slashes (e.g., `/a/:b/../../file`). The upstream fix was introduced in commit 8ee465103850a3dca018273fe5952e40d5c45a66 (May 2014) and shipped in Spring Framework 5.3.0. The target version 5.3....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in Spring Framework 5.3.6. The vulnerability allowed attackers to read arbitrary files via crafted URLs with path prefixes containing forward slashes (e.g., `/a/:b/../../file`). The upstream fix was introduced in commit 8ee465103850a3dca018273fe5952e40d5c45a66 (May 2014) and shipped in Spring Framework 5.3.0. The target version 5.3...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:10:37.699063+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.6-tuxcare.2 is NOT affected by CVE-2015-0201. The vulnerability involved predictable session ID generation in the SockJS Java client (versions 4.1.x before 4.1.5), which used AlternativeJdkIdGenerator that relies on java.util.Random after initial seeding. The fix was applied upstream in commit 52b8f344 (January 2015) by switching to JdkIdGenerator that uses UUID....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.6-tuxcare.2 is NOT affected by CVE-2015-0201. The vulnerability involved predictable session ID generation in the SockJS Java client (versions 4.1.x before 4.1.5), which used AlternativeJdkIdGenerator that relies on java.util.Random after initial seeding. The fix was applied upstream in commit 52b8f344 (January 2015) by switching to JdkIdGenerator that uses UUID...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:00:16.038874+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.6 is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). The fix for this vulnerability was committed to the upstream Spring Framework repository on 2015-10-04 (commit 2bd1daa75e \"Protect against RFD exploits\") by Rossen Stoyanchev from Pivotal, and was included starting from Spring Framework v4.2.2.RELEASE. Version 5.3.6 (released in 2021) is significantly newer and includes this upstream fix. The target code contains the complete RFD defense: AbstractMessageConverterMethodProcessor.addContentDispositionHeader() validates file extensions against a whitelist (SAFE_EXTENSIONS) and adds Content-Disposition header with safe filename for unsafe extensions. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.3.6 is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). The fix for this vulnerability was committed to the upstream Spring Framework repository on 2015-10-04 (commit 2bd1daa75e \"Protect against RFD exploits\") by Rossen Stoyanchev from Pivotal, and was included starting from Spring Framework v4.2.2.RELEASE. Version 5.3.6 (released in 2021) is significantly newer and includes this upstream fix. The target code contains the complete RFD defense: AbstractMessageConverterMethodProcessor.addContentDispositionHeader() validates file extensions against a whitelist (SAFE_EXTENSIONS) and adds Content-Disposition header with safe filename for unsafe extensions. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:11.896857+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 fix is already present in Spring Framework 5.3.6. The vulnerability concerned pattern matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. The upstream fix (commit a30ab30e4e, SPR-14321) introduced the HandlerMappingIntrospector API, MatchableHandlerMapping interface, and RequestMatchResult class to allow Spring Security to use Spring MVC's exact pattern matching logic. This fix was authored by upstream Spring developer Rossen Stoyanchev and was already included in the upstream 5.3.6 release that TuxCare onboarded. All fix components are present and fully implemented in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 fix is already present in Spring Framework 5.3.6. The vulnerability concerned pattern matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. The upstream fix (commit a30ab30e4e, SPR-14321) introduced the HandlerMappingIntrospector API, MatchableHandlerMapping interface, and RequestMatchResult class to allow Spring Security to use Spring MVC's exact pattern matching logic. This fix was authored by upstream Spring developer Rossen Stoyanchev and was already included in the upstream 5.3.6 release that TuxCare onboarded. All fix components are present and fully implemented in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:54:41.040148+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 due to automatic JSONP support. The target version 5.3.6 is NOT affected because JSONP support was completely removed from Spring Framework starting in v5.1.0.RC1 (June 2018). The target does not contain any JSONP-related code, classes, or methods. The removal was performed by upstream Spring Framework developers and was already present in the upstream 5.3.6 release that TuxCare onboarded in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 due to automatic JSONP support. The target version 5.3.6 is NOT affected because JSONP support was completely removed from Spring Framework starting in v5.1.0.RC1 (June 2018). The target does not contain any JSONP-related code, classes, or methods. The removal was performed by upstream Spring Framework developers and was already present in the upstream 5.3.6 release that TuxCare onboarded in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:03:00.096337+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.3.6. The vulnerability affects versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The target version 5.3.6 is significantly newer and contains all upstream fixes introduced in Spring Framework 5.0.3-5.0.5 (March 2018). These fixes were authored by Pivotal engineers and shipped in the upstream release that TuxCare onboarded as version 5.3.6. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.3.6. The vulnerability affects versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The target version 5.3.6 is significantly newer and contains all upstream fixes introduced in Spring Framework 5.0.3-5.0.5 (March 2018). These fixes were authored by Pivotal engineers and shipped in the upstream release that TuxCare onboarded as version 5.3.6. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T09:10:31.335583+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.3.6. The vulnerability involved unconditional parsing of selector header expressions in STOMP subscriptions, allowing malicious Spring EL expressions to cause DoS via excessive CPU consumption. The upstream fix (commit ff2228fdaf by Rossen Stoyanchev, April 2018) added a null-check wrapper that prevents selector expression parsing when the feat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.3.6. The vulnerability involved unconditional parsing of selector header expressions in STOMP subscriptions, allowing malicious Spring EL expressions to cause DoS via excessive CPU consumption. The upstream fix (commit ff2228fdaf by Rossen Stoyanchev, April 2018) added a null-check wrapper that prevents selector expression parsing when the feat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.6 is NOT affected by CVE-2018-1258. The vulnerability involved incorrect method resolution when dealing with JDK dynamic proxies, causing security annotations (e.g., @PreAuthorize, @Secured) to be bypassed. All required fixes were already present in the upstream Spring Framework 5.3.6 release that TuxCare onboarded. The fixes were introduced by upstream commits aa11721ff0 (AopUtils.getMostSpecificMethod) and eaff2c28a7 (CacheAspectSupport/ApplicationListenerMethodAdapter) authored by Juergen Hoeller on 2018-04-27, well before the 5.3.6 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.3.6 is NOT affected by CVE-2018-1258. The vulnerability involved incorrect method resolution when dealing with JDK dynamic proxies, causing security annotations (e.g., @PreAuthorize, @Secured) to be bypassed. All required fixes were already present in the upstream Spring Framework 5.3.6 release that TuxCare onboarded. The fixes were introduced by upstream commits aa11721ff0 (AopUtils.getMostSpecificMethod) and eaff2c28a7 (CacheAspectSupport/ApplicationListenerMethodAdapter) authored by Juergen Hoeller on 2018-04-27, well before the 5.3.6 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:40:00.178170+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target version 5.3.6 is not affected by CVE-2018-1271. The vulnerability affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. Version 5.3.6 was released in March 2021, well after the fixes were applied in Spring Framework 5.0.5 (March 2018). The upstream fix commits are present in the target's ancestry and were shipped in the upstream release before TuxCare onboarding. Code insp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Target version 5.3.6 is not affected by CVE-2018-1271. The vulnerability affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. Version 5.3.6 was released in March 2021, well after the fixes were applied in Spring Framework 5.0.5 (March 2018). The upstream fix commits are present in the target's ancestry and were shipped in the upstream release before TuxCare onboarding. Code insp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.3.6 is not affected by CVE-2018-1272. The vulnerability pattern (predictable multipart boundary generation using insecure Random) is not present in the code. The target uses SecureRandom for boundary generation via the initRandom() method (line 377), which was introduced by upstream Spring Framework commit 847202c8f8 in June 2018. This fix was already included in the Spring Framework 5.3.6 release that TuxCare onboarded in September 2026, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "The target Spring Framework 5.3.6 is not affected by CVE-2018-1272. The vulnerability pattern (predictable multipart boundary generation using insecure Random) is not present in the code. The target uses SecureRandom for boundary generation via the initRandom() method (line 377), which was introduced by upstream Spring Framework commit 847202c8f8 in June 2018. This fix was already included in the Spring Framework 5.3.6 release that TuxCare onboarded in September 2026, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:59.528750+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.6 is NOT AFFECTED by CVE-2018-15756. The vulnerability (DoS via excessive Range header ranges) was fixed by upstream commit 423aa28ed5 authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) and shipped in the Spring Framework 5.3.6 release. The fix adds two defenses: (1) MAX_RANGES=100 limit in parseRanges() rejecting Range headers with >100 ranges, and (2) overlap detection in toResourceRegions() rejecting multi-range requests where sum of ranges >= resource length. Both defenses are present in the target at HttpRange.java lines 48, 136-138, and 185-195. The fix predates TuxCare's onboarding of version 5.3.6 (commit 12c4dd35f9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 5.3.6 is NOT AFFECTED by CVE-2018-15756. The vulnerability (DoS via excessive Range header ranges) was fixed by upstream commit 423aa28ed5 authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) and shipped in the Spring Framework 5.3.6 release. The fix adds two defenses: (1) MAX_RANGES=100 limit in parseRanges() rejecting Range headers with >100 ranges, and (2) overlap detection in toResourceRegions() rejecting multi-range requests where sum of ranges >= resource length. Both defenses are present in the target at HttpRange.java lines 48, 136-138, and 185-195. The fix predates TuxCare's onboarding of version 5.3.6 (commit 12c4dd35f9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T23:45:53.087893+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.3.6-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.6-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.3.6-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.6-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.3.6-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:39:22.988337+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.3.6-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.3.6-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T23:45:53.087893+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.3.6-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.6-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.3.6-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.6-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T23:47:00.103733+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.6-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.6-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.6-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.6-tuxcare.3."
    }
  ]
}