{
  "@id": "urn:uuid:67413283-83ed-4435-b246-a81fc282a272",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 48,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:22:46.193289+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T12:09:48.333130+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.7 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK versions before 1.6 (JDK 1.5 and earlier). Spring Framework 5.3.7 requires JDK 8+ as its minimum runtime environment, which contains the fix for this JDK-level vulnerability. The vulnerability cannot manifest because the buggy JDK impl...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.7 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK versions before 1.6 (JDK 1.5 and earlier). Spring Framework 5.3.7 requires JDK 8+ as its minimum runtime environment, which contains the fix for this JDK-level vulnerability. The vulnerability cannot manifest because the buggy JDK impl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T17:30:26.757723+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T09:36:36.227311+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5. The target is Spring Framework 5.3.7-tuxcare.11, which already contains the upstream fix from 2011. The fix adds an acceptProxyClasses flag that blocks deserialization of Java Proxy classes when disabled. All three fixed components (ConfigurableObjectInputStream, CodebaseAwareObjectInputStream, RemoteInvocationSerializingExporter) contain the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5. The target is Spring Framework 5.3.7-tuxcare.11, which already contains the upstream fix from 2011. The fix adds an acceptProxyClasses flag that blocks deserialization of Java Proxy classes when disabled. All three fixed components (ConfigurableObjectInputStream, CodebaseAwareObjectInputStream, RemoteInvocationSerializingExporter) contain the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in Spring Framework 5.3.7-tuxcare.11. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) that prevents path traversal via malformed prefix patterns was already included in the Spring Framework 5.3.7 release before TuxCare onboarded it. The fix adds validation in StringUtils.cleanPath() to reject prefixes containing f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in Spring Framework 5.3.7-tuxcare.11. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) that prevents path traversal via malformed prefix patterns was already included in the Spring Framework 5.3.7 release before TuxCare onboarded it. The fix adds validation in StringUtils.cleanPath() to reject prefixes containing f..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:46.375124+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs. The target version 5.3.7 is not affected because the vulnerability was fixed in upstream Spring Framework 4.1.5 (January 2015) by replacing the predictable AlternativeJdkIdGenerator with the cryptographically secure JdkIdGenerator that uses UUID.randomUUID(). This upstream ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs. The target version 5.3.7 is not affected because the vulnerability was fixed in upstream Spring Framework 4.1.5 (January 2015) by replacing the predictable AlternativeJdkIdGenerator with the cryptographically secure JdkIdGenerator that uses UUID.randomUUID(). This upstream ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. Spring Framework 5.3.7 is not affected by CVE-2015-5211 (Reflected File Download). The vulnerability was fixed in the upstream Spring Framework project in October 2015 (commit 2bd1daa75e by Rossen Stoyanchev), years before the 5.3.7 release. The fix includes: (1) Content-Disposition header injection for responses with non-whitelisted file extensions, (2) JSONP callback parameter validation, (3) path validation to reject semicolons, and (4) improved URL filename extraction. All defense mechanisms are present and active in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.3.7 is not affected by CVE-2015-5211 (Reflected File Download). The vulnerability was fixed in the upstream Spring Framework project in October 2015 (commit 2bd1daa75e by Rossen Stoyanchev), years before the 5.3.7 release. The fix includes: (1) Content-Disposition header injection for responses with non-whitelisted file extensions, (2) JSONP callback parameter validation, (3) path validation to reject semicolons, and (4) improved URL filename extraction. All defense mechanisms are present and active in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:09:44.726673+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.3.7. The vulnerability involved pattern matching discrepancies between Spring Security's authorization checks and Spring MVC's handler mappings, allowing authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev) introduced HandlerMappingIntrospector and MatchableHandlerMapping API, enabling Spring Security to use the exact same matching logic as Spring MVC. This fix was shipped in the upstream Spring Framework release that TuxCare onboarded and is present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.3.7. The vulnerability involved pattern matching discrepancies between Spring Security's authorization checks and Spring MVC's handler mappings, allowing authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev) introduced HandlerMappingIntrospector and MatchableHandlerMapping API, enabling Spring Security to use the exact same matching logic as Spring MVC. This fix was shipped in the upstream Spring Framework release that TuxCare onboarded and is present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:51:14.737145+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. Spring Framework 5.3.7 is not affected by CVE-2018-11040 because JSONP support was completely removed from the upstream codebase in Spring Framework 5.1.0.RC1 (commit ac37b678a3, June 2018), well before the 5.3.x release line (October 2020). The vulnerable code patterns mentioned in the CVE\u2014MappingJackson2JsonView's jsonpParameterNames field initialized with [\"jsonp\", \"callback\"], and the AbstractJsonpResponseBodyAdvice class\u2014no longer exist in version 5.3.7. The removal was performed by upstream Spring maintainer Sebastien Deleuze and shipped in the upstream release that TuxCare onboarded for the 5.3.7 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.7 is not affected by CVE-2018-11040 because JSONP support was completely removed from the upstream codebase in Spring Framework 5.1.0.RC1 (commit ac37b678a3, June 2018), well before the 5.3.x release line (October 2020). The vulnerable code patterns mentioned in the CVE\u2014MappingJackson2JsonView's jsonpParameterNames field initialized with [\"jsonp\", \"callback\"], and the AbstractJsonpResponseBodyAdvice class\u2014no longer exist in version 5.3.7. The removal was performed by upstream Spring maintainer Sebastien Deleuze and shipped in the upstream release that TuxCare onboarded for the 5.3.7 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T00:56:00.067711+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.7-tuxcare.11 is not affected by CVE-2018-1199. The vulnerability (bypassing security constraints via encoded path parameters with special encodings) was fixed in upstream Spring Framework commits 0e28bee0f1, 91b803a231, and related patches (SPR-16616, SPR-16526, SPR-16296) authored by Spring/Pivotal developers in March 2018. These fixes were included in the Spring Framework...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.7-tuxcare.11 is not affected by CVE-2018-1199. The vulnerability (bypassing security constraints via encoded path parameters with special encodings) was fixed in upstream Spring Framework commits 0e28bee0f1, 91b803a231, and related patches (SPR-16616, SPR-16526, SPR-16296) authored by Spring/Pivotal developers in March 2018. These fixes were included in the Spring Framework..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T09:01:17.494754+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.7 is NOT AFFECTED by CVE-2018-1257. The vulnerability pattern is absent because the fix was already present in the upstream 5.3.7 release shipped by the Spring team in May 2021, well after the CVE was addressed in versions 4.3.17 and 5.0.6 in April 2018. The target code includes the complete mitigation: a null check that prevents selector header parsing when the feature is ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.7 is NOT AFFECTED by CVE-2018-1257. The vulnerability pattern is absent because the fix was already present in the upstream 5.3.7 release shipped by the Spring team in May 2021, well after the CVE was addressed in versions 4.3.17 and 5.0.6 in April 2018. The target code includes the complete mitigation: a null check that prevents selector header parsing when the feature is ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. Spring Framework 5.3.7 is not affected by CVE-2018-1258. The vulnerability affected version 5.0.5 where incorrect method resolution for JDK dynamic proxies caused Spring Security method-level authorization annotations to be bypassed. The upstream fix was introduced in Spring Framework 5.1.0.RC1 (April 2018) by Juergen Hoeller and is present in all subsequent releases including 5.3.7. The fix ensures correct target method resolution for annotation evaluation even when using interface-based proxies, preventing the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.3.7 is not affected by CVE-2018-1258. The vulnerability affected version 5.0.5 where incorrect method resolution for JDK dynamic proxies caused Spring Security method-level authorization annotations to be bypassed. The upstream fix was introduced in Spring Framework 5.1.0.RC1 (April 2018) by Juergen Hoeller and is present in all subsequent releases including 5.3.7. The fix ensures correct target method resolution for annotation evaluation even when using interface-based proxies, preventing the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T18:28:50.149316+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is not present in Spring Framework 5.3.7. This directory traversal vulnerability affects versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The fix was included in the upstream Spring Framework 5.3.7 release. Both spring-webmvc and spring-webflux modules contain the isInvalidEncodedPath() method that validates URL-decoded paths and rejects any containing \"../\" or \"..\\\\\" sequence...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is not present in Spring Framework 5.3.7. This directory traversal vulnerability affects versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The fix was included in the upstream Spring Framework 5.3.7 release. Both spring-webmvc and spring-webflux modules contain the isInvalidEncodedPath() method that validates URL-decoded paths and rejects any containing \"../\" or \"..\\\\\" sequence..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework's multipart boundary generation. The vulnerability allowed attackers to predict multipart boundaries generated with non-secure Random(), enabling injection of additional multipart sections that could lead to privilege escalation. The upstream fix (commit ab2410c754) replaced new Random() with new SecureRandom() for cryptographically secure, unpredictable boundary generation. This fix was already present in Spring Framework 5.3.7 when TuxCare onboarded it (first TuxCare commit 48017278bc). The target version 5.3.7-tuxcare.10 is not affected because the vulnerable code pattern does not exist - it was fixed by the upstream vendor before TuxCare's initial setup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework's multipart boundary generation. The vulnerability allowed attackers to predict multipart boundaries generated with non-secure Random(), enabling injection of additional multipart sections that could lead to privilege escalation. The upstream fix (commit ab2410c754) replaced new Random() with new SecureRandom() for cryptographically secure, unpredictable boundary generation. This fix was already present in Spring Framework 5.3.7 when TuxCare onboarded it (first TuxCare commit 48017278bc). The target version 5.3.7-tuxcare.10 is not affected because the vulnerable code pattern does not exist - it was fixed by the upstream vendor before TuxCare's initial setup.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:59.098532+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. CVE-2018-15756 is not present in Spring Framework 5.3.7. The upstream fix (commit 423aa28ed5) was already included in the v5.3.7 release that TuxCare onboarded. The code contains both required defenses: (1) MAX_RANGES=100 limit in parseRanges() at line 136-138, and (2) sum-of-ranges validation in toResourceRegions() at lines 185-195. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from Pivotal/Spring team on Oct 3, 2018, predating TuxCare's initial setup commit (48017278bc) by 5138 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is not present in Spring Framework 5.3.7. The upstream fix (commit 423aa28ed5) was already included in the v5.3.7 release that TuxCare onboarded. The code contains both required defenses: (1) MAX_RANGES=100 limit in parseRanges() at line 136-138, and (2) sum-of-ranges validation in toResourceRegions() at lines 185-195. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from Pivotal/Spring team on Oct 3, 2018, predating TuxCare's initial setup commit (48017278bc) by 5138 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 is fixed in version 5.3.7-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.3.7-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.7-tuxcare.3 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the cached request-URI regex comparison that causes the vulnerability. Requests are wrapped and handler mappings resolved directly in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:165; the attribute-preserving wrapper at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:256 has no CachedResult, cache API, or request-URI regex comparison.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the cached request-URI regex comparison that causes the vulnerability. Requests are wrapped and handler mappings resolved directly in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:165; the attribute-preserving wrapper at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:256 has no CachedResult, cache API, or request-URI regex comparison."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.3.7-tuxcare.3 of org.springframework:spring-core, and is fixed in 5.3.7-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.3.7-tuxcare.3 of org.springframework:spring-core, and is fixed in 5.3.7-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.7-tuxcare.3 of org.springframework:spring-core, and is fixed in 5.3.7-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.7-tuxcare.3 of org.springframework:spring-core, and is fixed in 5.3.7-tuxcare.9."
    }
  ]
}