{
  "@id": "urn:uuid:69aff92f-59aa-4a42-b692-2d49c72b9036",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 49,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:24:00.586682+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T12:44:06.454395+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 does not affect Spring Framework 6.0.12. The vulnerability requires Pattern.compile() to be invoked during deserialization with attacker-controlled regex patterns. In version 6.0.12, JdkRegexpMethodPointcut serializes compiled Pattern objects directly (Pattern implements Serializable since Java 1.5) and has no readObject() method to trigger pattern recompilation. The attack chain ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 does not affect Spring Framework 6.0.12. The vulnerability requires Pattern.compile() to be invoked during deserialization with attacker-controlled regex patterns. In version 6.0.12, JdkRegexpMethodPointcut serializes compiled Pattern objects directly (Pattern implements Serializable since Java 1.5) and has no readObject() method to trigger pattern recompilation. The attack chain ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T17:38:00.045928+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T09:47:00.137511+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.12 is not affected by CVE-2011-2894. The vulnerable attack surface (Spring Remoting - RMI and HTTP Invoker classes) was completely removed from Spring Framework in upstream commit 5822f1bf85 (Sept 2021) by Juergen Hoeller, well before version 6.0.12 was released. This upstream removal eliminated the code path that automatically deserialized untrusted network input. While Co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.12 is not affected by CVE-2011-2894. The vulnerable attack surface (Spring Remoting - RMI and HTTP Invoker classes) was completely removed from Spring Framework in upstream commit 5822f1bf85 (Sept 2021) by Juergen Hoeller, well before version 6.0.12 was released. This upstream removal eliminated the code path that automatically deserialized untrusted network input. While Co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.12-tuxcare.7 is NOT AFFECTED by CVE-2014-3578. The directory traversal vulnerability in StringUtils.cleanPath() was fixed by upstream Spring Framework in May 2014 (versions 3.2.18, 4.0.9, 4.1.0.RC1). The fix adds a check that discards prefixes containing forward slashes, preventing URI-like path components from being misinterpreted as valid prefixes that enable directory tr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.12-tuxcare.7 is NOT AFFECTED by CVE-2014-3578. The directory traversal vulnerability in StringUtils.cleanPath() was fixed by upstream Spring Framework in May 2014 (versions 3.2.18, 4.0.9, 4.1.0.RC1). The fix adds a check that discards prefixes containing forward slashes, preventing URI-like path components from being misinterpreted as valid prefixes that enable directory tr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:14:03.234394+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used java.util.Random after an initial SecureRandom seed). This allowed attackers to predict session IDs and send messages to other sessions. The vulnerability was fixed in Spring Framework 4.1.5 (January 2015) by commit d63cfc8eeb, wh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used java.util.Random after an initial SecureRandom seed). This allowed attackers to predict session IDs and send messages to other sessions. The vulnerability was fixed in Spring Framework 4.1.5 (January 2015) by commit d63cfc8eeb, wh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:05:07.573388+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.0.12-tuxcare.6. The upstream fix commit 2bd1daa75e \"Protect against RFD exploits\" by Rossen Stoyanchev (Pivotal/VMware) was already included in the upstream Spring Framework 6.0.12 release that TuxCare onboarded. The defense code (addContentDispositionHeader method) is present and functional, protecting against RFD by adding Content-Disposition headers with safe filenames for requests with non-whitelisted file extensions. Additionally, Spring 6.x has deprecated path extension-based content negotiation, further reducing the attack surface.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.0.12-tuxcare.6. The upstream fix commit 2bd1daa75e \"Protect against RFD exploits\" by Rossen Stoyanchev (Pivotal/VMware) was already included in the upstream Spring Framework 6.0.12 release that TuxCare onboarded. The defense code (addContentDispositionHeader method) is present and functional, protecting against RFD by adding Content-Disposition headers with safe filenames for requests with non-whitelisted file extensions. Additionally, Spring 6.x has deprecated path extension-based content negotiation, further reducing the attack surface.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:16:19.686333+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 6.0.12-tuxcare.6. The vulnerability concerned pattern matching differences between Spring Security and Spring MVC that could lead to authorization bypass. The fix (HandlerMappingIntrospector API) was introduced in Spring 4.3.1 (2016) by upstream author Rossen Stoyanchev and is present in the upstream Spring Framework 6.0.12 release that TuxCare onboarded. The introspection API allows Spring Security to query Spring MVC's actual URL pattern matching behavior, ensuring both systems interpret URL patterns identically.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 6.0.12-tuxcare.6. The vulnerability concerned pattern matching differences between Spring Security and Spring MVC that could lead to authorization bypass. The fix (HandlerMappingIntrospector API) was introduced in Spring 4.3.1 (2016) by upstream author Rossen Stoyanchev and is present in the upstream Spring Framework 6.0.12 release that TuxCare onboarded. The introspection API allows Spring Security to query Spring MVC's actual URL pattern matching behavior, ensuring both systems interpret URL patterns identically.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:58.947122+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. Spring Framework 6.0.12 is not affected by CVE-2018-11040. The JSONP functionality that was the source of this vulnerability was completely removed from Spring Framework in version 5.1.0 (June 2018) by upstream commit ac37b678a3. Version 6.0.12 does not contain any JSONP code, including the MappingJackson2JsonView.jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, or any JSONP parameter processing logic. The vulnerability pattern (automatic JSONP wrapping via default parameter names) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.0.12 is not affected by CVE-2018-11040. The JSONP functionality that was the source of this vulnerability was completely removed from Spring Framework in version 5.1.0 (June 2018) by upstream commit ac37b678a3. Version 6.0.12 does not contain any JSONP code, including the MappingJackson2JsonView.jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, or any JSONP parameter processing logic. The vulnerability pattern (automatic JSONP wrapping via default parameter names) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T01:08:03.517113+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 6.0.12-tuxcare.7. The vulnerability involved URL path parameter handling that allowed security constraint bypass through specially-encoded path traversal sequences. The upstream Spring Framework project fixed this in multiple commits (SPR-16616, SPR-16296, SPR-16526) during March 2018, introducing path separator normalization (backslash\u2192forward s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 6.0.12-tuxcare.7. The vulnerability involved URL path parameter handling that allowed security constraint bypass through specially-encoded path traversal sequences. The upstream Spring Framework project fixed this in multiple commits (SPR-16616, SPR-16296, SPR-16526) during March 2018, introducing path separator normalization (backslash\u2192forward s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. CVE-2018-1258 is not present in Spring Framework 6.0.12-tuxcare.7. The vulnerability, which allowed authorization bypass via JDK dynamic proxies failing to resolve method annotations, was fixed by upstream Spring Framework in April 2018 (commits aa11721ff0 and eaff2c28a7). Both fixes were already included in the upstream 6.0.12 release that TuxCare onboarded. The vulnerable pattern is absent: AopUtils.getMostSpecificMethod() correctly resolves proxy methods, AnnotationMethodMatcher has proxy guards, and cache/event code uses early method resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is not present in Spring Framework 6.0.12-tuxcare.7. The vulnerability, which allowed authorization bypass via JDK dynamic proxies failing to resolve method annotations, was fixed by upstream Spring Framework in April 2018 (commits aa11721ff0 and eaff2c28a7). Both fixes were already included in the upstream 6.0.12 release that TuxCare onboarded. The vulnerable pattern is absent: AopUtils.getMostSpecificMethod() correctly resolves proxy methods, AnnotationMethodMatcher has proxy guards, and cache/event code uses early method resolution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T18:57:19.396013+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.12 is not affected by CVE-2018-1271 (directory traversal via percent-encoded path sequences). The vulnerability fix was introduced by upstream Spring developer Juergen Hoeller in commit 91b803a231 (March 21, 2018) and shipped in the upstream 6.0.12 release before TuxCare onboarded it. The fix adds URL decoding validation via isInvalidEncodedPath() methods in both spring-web...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.12 is not affected by CVE-2018-1271 (directory traversal via percent-encoded path sequences). The vulnerability fix was introduced by upstream Spring developer Juergen Hoeller in commit 91b803a231 (March 21, 2018) and shipped in the upstream 6.0.12 release before TuxCare onboarded it. The fix adds URL decoding validation via isInvalidEncodedPath() methods in both spring-web..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework versions using weak Random for multipart boundary generation, allowing attackers to predict boundaries and inject malicious multipart sections. The target Spring Framework 6.0.12-tuxcare.6 is NOT affected because it already contains the upstream fix (commit ab2410c754 from March 2018) that replaced Random with SecureRandom for unpredictable boundary generation. This fix was shipped in the upstream Spring 6.0.12 release that TuxCare onboarded in August 2026, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework versions using weak Random for multipart boundary generation, allowing attackers to predict boundaries and inject malicious multipart sections. The target Spring Framework 6.0.12-tuxcare.6 is NOT affected because it already contains the upstream fix (commit ab2410c754 from March 2018) that replaced Random with SecureRandom for unpredictable boundary generation. This fix was shipped in the upstream Spring 6.0.12 release that TuxCare onboarded in August 2026, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:43.996674+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. CVE-2018-15756 does not affect Spring Framework 6.0.12. The vulnerability involves DoS through malicious HTTP Range headers with excessive ranges or overlapping ranges. The upstream fix (commit 423aa28ed5 from October 2018) was already present in the 6.0.12 release that TuxCare onboarded. The target code contains both required defenses: (1) MAX_RANGES=100 limit in parseRanges() at lines 136-138, and (2) overlapping range validation in toResourceRegions() at lines 185-195. The fix was authored by rstoyanchev@pivotal.io (upstream), not TuxCare, and predates the first TuxCare onboarding commit (fb33a3173a). Version 6.0.12 (2023) is significantly newer than the affected versions (5.1, 5.0.x < 5.0.10, 4.3.x < 4.3.20).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 does not affect Spring Framework 6.0.12. The vulnerability involves DoS through malicious HTTP Range headers with excessive ranges or overlapping ranges. The upstream fix (commit 423aa28ed5 from October 2018) was already present in the 6.0.12 release that TuxCare onboarded. The target code contains both required defenses: (1) MAX_RANGES=100 limit in parseRanges() at lines 136-138, and (2) overlapping range validation in toResourceRegions() at lines 185-195. The fix was authored by rstoyanchev@pivotal.io (upstream), not TuxCare, and predates the first TuxCare onboarding commit (fb33a3173a). Version 6.0.12 (2023) is significantly newer than the affected versions (5.1, 5.0.x < 5.0.10, 4.3.x < 4.3.20).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T20:48:39.321134+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.12 is NOT affected by CVE-2021-22060 (log injection via newlines and control characters). The fix was already present in the upstream 6.0.12 release when TuxCare onboarded it. LogFormatUtils contains NEWLINE_PATTERN and CONTROL_CHARACTER_PATTERN defenses that replace newlines with <EOL> and control characters with ? before logging. All user-controlled resource paths, URI pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.12 is NOT affected by CVE-2021-22060 (log injection via newlines and control characters). The fix was already present in the upstream 6.0.12 release when TuxCare onboarded it. LogFormatUtils contains NEWLINE_PATTERN and CONTROL_CHARACTER_PATTERN defenses that replace newlines with <EOL> and control characters with ? before logging. All user-controlled resource paths, URI pa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T21:36:05.503461+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.12 is not affected by CVE-2021-22096 (log injection vulnerability). The upstream fix that sanitizes log messages by replacing newline characters with <EOL> and control characters with ? was already included in the Spring Framework 6.0.12 release before TuxCare onboarded it. The fix commit (99c7608f) was authored by Rossen Stoyanchev from the upstream Spring team and is an a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.12 is not affected by CVE-2021-22096 (log injection vulnerability). The upstream fix that sanitizes log messages by replacing newline characters with <EOL> and control characters with ? was already included in the Spring Framework 6.0.12 release before TuxCare onboarded it. The fix commit (99c7608f) was authored by Rossen Stoyanchev from the upstream Spring team and is an a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:24:00.586682+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.0.12-tuxcare.4 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the cached request URI comparison that causes the vulnerability. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:166 and :219, requests are wrapped and handler mappings are resolved directly, without a cached-result lookup or URI comparison; the inner classes at :257 and :298 contain no vulnerable CachedResult implementation.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the cached request URI comparison that causes the vulnerability. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:166 and :219, requests are wrapped and handler mappings are resolved directly, without a cached-result lookup or URI comparison; the inner classes at :257 and :298 contain no vulnerable CachedResult implementation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-21T12:26:00.092842+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 6.0.12-tuxcare.4 of org.springframework:spring-core, and is fixed in 6.0.12-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 6.0.12-tuxcare.4 of org.springframework:spring-core, and is fixed in 6.0.12-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-21T12:26:00.092842+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.0.12-tuxcare.4 of org.springframework:spring-core, and is fixed in 6.0.12-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.0.12-tuxcare.4 of org.springframework:spring-core, and is fixed in 6.0.12-tuxcare.6."
    }
  ]
}