{
  "@id": "urn:uuid:6e84f827-e13c-4e32-ab0a-1e48fdd23159",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 53,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:23:42.223331+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:43:00.299427+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in Java's regex engine (JDK before 1.6) that could be triggered via Spring Framework's PatternEditor. While Spring Framework 6.0.0 still contains the PatternEditor code that calls Pattern.compile() without validation, the underlying JDK vulnerability does not exist in this version's required runtime environment (Java 17). The CVE e...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in Java's regex engine (JDK before 1.6) that could be triggered via Spring Framework's PatternEditor. While Spring Framework 6.0.0 still contains the PatternEditor code that calls Pattern.compile() without validation, the underlying JDK vulnerability does not exist in this version's required runtime environment (Java 17). The CVE e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:38:00.045928+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.0 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.0 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:47:00.137511+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.0 is not affected by CVE-2011-2894. The vulnerable RMI remoting attack surface (CodebaseAwareObjectInputStream, RemoteInvocationSerializingExporter) was completely removed in Spring Framework 6.0 (commit 5822f1bf85, Sept 2021). Additionally, the base ConfigurableObjectInputStream class has the acceptProxyClasses defense mechanism that was added by upstream maintainer Juerge...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.0 is not affected by CVE-2011-2894. The vulnerable RMI remoting attack surface (CodebaseAwareObjectInputStream, RemoteInvocationSerializingExporter) was completely removed in Spring Framework 6.0 (commit 5822f1bf85, Sept 2021). Additionally, the base ConfigurableObjectInputStream class has the acceptProxyClasses defense mechanism that was added by upstream maintainer Juerge..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 6.0.0-tuxcare.6. The vulnerability, which allowed directory traversal via crafted URLs containing colons followed by '..' sequences (e.g., /a/:b/../../file), was fixed in the upstream Spring Framework before version 6.0.0. The fix (commit 8ee4651038 by Rossen Stoyanchev) adds a check in StringUtils.cleanPath() that discards any prefix containing ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 6.0.0-tuxcare.6. The vulnerability, which allowed directory traversal via crafted URLs containing colons followed by '..' sequences (e.g., /a/:b/../../file), was fixed in the upstream Spring Framework before version 6.0.0. The fix (commit 8ee4651038 by Rossen Stoyanchev) adds a check in StringUtils.cleanPath() that discards any prefix containing ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:14:03.234394+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in Spring Framework 4.1.5 (January 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator, which uses cryptographically secure UUID.randomUUID(). The target repository (Spring Framework 6.2.5-tuxcare.4) was onboarded from upstream ve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in Spring Framework 4.1.5 (January 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator, which uses cryptographically secure UUID.randomUUID(). The target repository (Spring Framework 6.2.5-tuxcare.4) was onboarded from upstream ve..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:04:07.366670+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. The target Spring Framework 6.0.0 is not affected by CVE-2015-5211 (Reflected File Download vulnerability). The upstream vendor fixed this vulnerability in October 2015 (commit 2bd1daa), which was incorporated into all subsequent Spring Framework releases including 6.0.0 (released November 2022). The fix includes Content-Disposition header protection for unsafe file extensions and was enhanced by the complete removal of JSONP support in June 2018. Both protections were already present in the upstream 6.0.0 release when TuxCare onboarded it in August 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "The target Spring Framework 6.0.0 is not affected by CVE-2015-5211 (Reflected File Download vulnerability). The upstream vendor fixed this vulnerability in October 2015 (commit 2bd1daa), which was incorporated into all subsequent Spring Framework releases including 6.0.0 (released November 2022). The fix includes Content-Disposition header protection for unsafe file extensions and was enhanced by the complete removal of JSONP support in June 2018. Both protections were already present in the upstream 6.0.0 release when TuxCare onboarded it in August 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:16:19.686333+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. Target version 6.0.0 is NOT affected by CVE-2016-5007. The fix (HandlerMappingIntrospector API) was already present in the upstream Spring Framework 6.0.0 release that TuxCare onboarded. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit a30ab30e4e and existed before TuxCare's first onboarding commit (f140461cc7). The defense mechanism provides a unified introspection API allowing Spring Security to use the same path-matching logic as Spring MVC, eliminating the authorization bypass vulnerability caused by pattern-matching discrepancies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Target version 6.0.0 is NOT affected by CVE-2016-5007. The fix (HandlerMappingIntrospector API) was already present in the upstream Spring Framework 6.0.0 release that TuxCare onboarded. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit a30ab30e4e and existed before TuxCare's first onboarding commit (f140461cc7). The defense mechanism provides a unified introspection API allowing Spring Security to use the same path-matching logic as Spring MVC, eliminating the authorization bypass vulnerability caused by pattern-matching discrepancies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:31.761827+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.0.0 is not affected by CVE-2018-11040. The entire JSONP support mechanism (both MappingJackson2JsonView automatic parameter handling and AbstractJsonpResponseBodyAdvice) was completely removed from the codebase in upstream commit ac37b678a3 (June 2018) by Sebastien Deleuze, approximately 9,087 commits before the 6.0.0 release. The vulnerable code pattern that automatically enabled JSONP via \"jsonp\" and \"callback\" query parameters does not exist anywhere in the target. CORS is now the recommended approach for cross-domain requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.0.0 is not affected by CVE-2018-11040. The entire JSONP support mechanism (both MappingJackson2JsonView automatic parameter handling and AbstractJsonpResponseBodyAdvice) was completely removed from the codebase in upstream commit ac37b678a3 (June 2018) by Sebastien Deleuze, approximately 9,087 commits before the 6.0.0 release. The vulnerable code pattern that automatically enabled JSONP via \"jsonp\" and \"callback\" query parameters does not exist anywhere in the target. CORS is now the recommended approach for cross-domain requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:07:00.075690+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 fix is already present in Spring Framework 6.0.0. The vulnerability allowed path traversal via URL-encoded path parameters with duplicate slashes and backslashes. The upstream fix (commit 0e28bee0f1, SPR-16616) added path normalization (duplicate slash removal, backslash-to-slash conversion) and post-decode validation for encoded traversal sequences, preventing the attack. This fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 fix is already present in Spring Framework 6.0.0. The vulnerability allowed path traversal via URL-encoded path parameters with duplicate slashes and backslashes. The upstream fix (commit 0e28bee0f1, SPR-16616) added path normalization (duplicate slash removal, backslash-to-slash conversion) and post-decode validation for encoded traversal sequences, preventing the attack. This fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 6.0.0. The vulnerability affected versions prior to 4.3.17 and 5.0.6. The fix (commit ff2228fdaf, April 2018) was authored by upstream Spring developer Rossen Stoyanchev and shipped in the upstream 6.0.0 release that TuxCare onboarded in August 2026. The vulnerable pattern\u2014unconditional parsing of attacker-controlled selector expressions without ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 6.0.0. The vulnerability affected versions prior to 4.3.17 and 5.0.6. The fix (commit ff2228fdaf, April 2018) was authored by upstream Spring developer Rossen Stoyanchev and shipped in the upstream 6.0.0 release that TuxCare onboarded in August 2026. The vulnerable pattern\u2014unconditional parsing of attacker-controlled selector expressions without ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. CVE-2018-1258 affected Spring Framework 5.0.5 when used with Spring Security, causing an authorization bypass in method security. The vulnerability occurred because AopUtils.getMostSpecificMethod() skipped JDK dynamic proxy classes, preventing security annotations on implementation classes from being found. The target repository (Spring Framework 6.0.0-tuxcare.6) is NOT vulnerable. The upstream fixes (commits aa11721ff0 and eaff2c28a7 by Juergen Hoeller, April 27, 2018) were already included in the Spring Framework 6.0.0 release that TuxCare onboarded. Both fix commits are ancestors of the first TuxCare commit (f140461cc7e), confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affected Spring Framework 5.0.5 when used with Spring Security, causing an authorization bypass in method security. The vulnerability occurred because AopUtils.getMostSpecificMethod() skipped JDK dynamic proxy classes, preventing security annotations on implementation classes from being found. The target repository (Spring Framework 6.0.0-tuxcare.6) is NOT vulnerable. The upstream fixes (commits aa11721ff0 and eaff2c28a7 by Juergen Hoeller, April 27, 2018) were already included in the Spring Framework 6.0.0 release that TuxCare onboarded. Both fix commits are ancestors of the first TuxCare commit (f140461cc7e), confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:51:00.529932+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 (directory traversal via URL-encoded paths in Windows static resource serving) is NOT present in Spring Framework 6.0.0-tuxcare.5. The fix was already included in the upstream Spring Framework 6.0.0 release that TuxCare onboarded. The target contains all required protections: backslash-to-forward-slash normalization, duplicate slash removal, and validation that rejects URL-decoded...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 (directory traversal via URL-encoded paths in Windows static resource serving) is NOT present in Spring Framework 6.0.0-tuxcare.5. The fix was already included in the upstream Spring Framework 6.0.0 release that TuxCare onboarded. The target contains all required protections: backslash-to-forward-slash normalization, duplicate slash removal, and validation that rejects URL-decoded..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. CVE-2018-1272 involves multipart boundary injection attacks enabled by predictable boundary generation using weak Random. The vulnerability allows attackers to craft content containing fake boundary strings that get honored by the recipient server, potentially leading to privilege escalation. The target Spring Framework 6.0.0 already uses SecureRandom for boundary generation (spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java line 412), making boundaries cryptographically unpredictable. This fix was introduced by upstream commit ab2410c754b67902f002bfcc0c3895bd7772d39f (Rossen Stoyanchev, March 23 2018) and was already present in the upstream Spring Framework 6.0.0 release when TuxCare onboarded it (first TuxCare commit f140461cc7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 involves multipart boundary injection attacks enabled by predictable boundary generation using weak Random. The vulnerability allows attackers to craft content containing fake boundary strings that get honored by the recipient server, potentially leading to privilege escalation. The target Spring Framework 6.0.0 already uses SecureRandom for boundary generation (spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java line 412), making boundaries cryptographically unpredictable. This fix was introduced by upstream commit ab2410c754b67902f002bfcc0c3895bd7772d39f (Rossen Stoyanchev, March 23 2018) and was already present in the upstream Spring Framework 6.0.0 release when TuxCare onboarded it (first TuxCare commit f140461cc7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:04.560309+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. Target version 6.0.0 is NOT AFFECTED by CVE-2018-15756. The vulnerability (DOS via malicious HTTP Range headers with excessive or overlapping ranges) has been fixed by upstream developer Rossen Stoyanchev in commit 423aa28ed5 (Oct 2018), which was already present in the upstream 6.0.0 release when TuxCare onboarded it. The fix adds two defenses: (1) MAX_RANGES=100 limit rejecting >100 ranges, and (2) validation ensuring total range bytes < resource length. Both defenses are active in the target code at spring-web/src/main/java/org/springframework/http/HttpRange.java lines 48, 136-138, and 185-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Target version 6.0.0 is NOT AFFECTED by CVE-2018-15756. The vulnerability (DOS via malicious HTTP Range headers with excessive or overlapping ranges) has been fixed by upstream developer Rossen Stoyanchev in commit 423aa28ed5 (Oct 2018), which was already present in the upstream 6.0.0 release when TuxCare onboarded it. The fix adds two defenses: (1) MAX_RANGES=100 limit rejecting >100 ranges, and (2) validation ensuring total range bytes < resource length. Both defenses are active in the target code at spring-web/src/main/java/org/springframework/http/HttpRange.java lines 48, 136-138, and 185-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:57.354813+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.0 is not affected by CVE-2021-22060 because the upstream fix was already present in the v6.0.0 release. The vulnerability affects versions 5.3.0-5.3.13, 5.2.0-5.2.18, and older versions. Version 6.0.0 (released 2022-11-16) includes the fix that was committed upstream on 2021-12-08, well before the 6.0.0 release. The defensive code (LogFormatUtils with newline and control ch...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.0 is not affected by CVE-2021-22060 because the upstream fix was already present in the v6.0.0 release. The vulnerability affects versions 5.3.0-5.3.13, 5.2.0-5.2.18, and older versions. Version 6.0.0 (released 2022-11-16) includes the fix that was committed upstream on 2021-12-08, well before the 6.0.0 release. The defensive code (LogFormatUtils with newline and control ch..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T21:31:37.582306+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters in user input) is NOT present in Spring Framework 6.0.0. The vulnerability affected versions 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. The upstream fix was introduced in December 2021 (commits 99c7608ffe, e9083d7d20, 05ea991d62 by Rossen Stoyanchev) and shipped with Spring Framework 6.0.0 release. The target at SHA c03e8a2db3 co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters in user input) is NOT present in Spring Framework 6.0.0. The vulnerability affected versions 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. The upstream fix was introduced in December 2021 (commits 99c7608ffe, e9083d7d20, 05ea991d62 by Rossen Stoyanchev) and shipped with Spring Framework 6.0.0 release. The target at SHA c03e8a2db3 co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:23:42.223331+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.0.0-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached URI comparison using a regular expression is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:165, the introspector wraps the request and resolves its handler mapping directly, without consulting cached results.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached URI comparison using a regular expression is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:165, the introspector wraps the request and resolves its handler mapping directly, without consulting cached results."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T12:55:00.705920+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 6.0.0-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.0.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 6.0.0-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.0.0-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T12:56:00.140885+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.0.0-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.0.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.0.0-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.0.0-tuxcare.5."
    }
  ]
}