{
  "@id": "urn:uuid:ea2da32f-6e45-4cb0-b566-cbae02477740",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 52,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:24:00.586682+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:48:47.236892+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is NOT present in Spring Framework 6.0.13-tuxcare.6. The vulnerability is an algorithmic complexity issue in java.util.regex.Pattern.compile in JDK versions before 1.6. The target repository uses JDK 17 (as configured in gradle.properties and build files), which includes the fixes introduced in JDK 1.6 and subsequent releases. While Spring Framework's PatternEditor still calls Pat...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is NOT present in Spring Framework 6.0.13-tuxcare.6. The vulnerability is an algorithmic complexity issue in java.util.regex.Pattern.compile in JDK versions before 1.6. The target repository uses JDK 17 (as configured in gradle.properties and build files), which includes the fixes introduced in JDK 1.6 and subsequent releases. While Spring Framework's PatternEditor still calls Pat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:39:00.028214+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:49:00.106689+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.13 is not affected by CVE-2011-2894. The vulnerability targeted RMI remoting classes (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) that allowed deserialization of malicious proxy classes. These classes were fixed in 2011 (commit 7d8aa05c407) and completely removed from the codebase in 2021 (commit 5822f1bf85). Both changes were upstream fixes that sh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.13 is not affected by CVE-2011-2894. The vulnerability targeted RMI remoting classes (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) that allowed deserialization of malicious proxy classes. These classes were fixed in 2011 (commit 7d8aa05c407) and completely removed from the codebase in 2021 (commit 5822f1bf85). Both changes were upstream fixes that sh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5, exploitable via crafted URLs with malformed URI prefix patterns (e.g., /a/:b/../../sensitive/file) that bypass path normalization in StringUtils.cleanPath(). The target is Spring Framework 6.0.13-tuxcare.7 (SHA 7bde73782d). The upstream fix commit 8ee465103850a3dca018273fe5952e40d5c45...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5, exploitable via crafted URLs with malformed URI prefix patterns (e.g., /a/:b/../../sensitive/file) that bypass path normalization in StringUtils.cleanPath(). The target is Spring Framework 6.0.13-tuxcare.7 (SHA 7bde73782d). The upstream fix commit 8ee465103850a3dca018273fe5952e40d5c45..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:15:37.688994+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client used a predictable session ID generator. The target version 6.0.13 contains the upstream fix (using JdkIdGenerator with UUID.randomUUID() instead of the vulnerable AlternativeJdkIdGenerator). The vulnerable code pattern is not present in this version - the fix was already included in the upstream Spring Frame...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client used a predictable session ID generator. The target version 6.0.13 contains the upstream fix (using JdkIdGenerator with UUID.randomUUID() instead of the vulnerable AlternativeJdkIdGenerator). The vulnerable code pattern is not present in this version - the fix was already included in the upstream Spring Frame..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:07:28.836714+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.0.13 is not affected by CVE-2015-5211 (Reflected File Download attack). The upstream vendor fix from October 2015 was already included in this release before TuxCare onboarding. Additionally, Spring Framework 6.x implements multiple architectural defenses: (1) path extension content negotiation is disabled by default (favorPathExtension=false), (2) JSONP support has been completely removed, and (3) UriUtils.extractFileExtension() properly strips path parameters (;), query parameters (?), and fragment identifiers (#) to prevent malicious extensions from affecting content type determination.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.0.13 is not affected by CVE-2015-5211 (Reflected File Download attack). The upstream vendor fix from October 2015 was already included in this release before TuxCare onboarding. Additionally, Spring Framework 6.x implements multiple architectural defenses: (1) path extension content negotiation is disabled by default (favorPathExtension=false), (2) JSONP support has been completely removed, and (3) UriUtils.extractFileExtension() properly strips path parameters (;), query parameters (?), and fragment identifiers (#) to prevent malicious extensions from affecting content type determination.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:11.201920+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 6.0.13-tuxcare.6. The vulnerability concerns path matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. The upstream fix (commit a30ab30e4e) introduced a HandlerMappingIntrospector API providing unified path matching, eliminating these discrepancies. This fix was already present in the upstream Spring Framework 6.0.13 release that TuxCare onboarded, so the vulnerable code pattern never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 6.0.13-tuxcare.6. The vulnerability concerns path matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. The upstream fix (commit a30ab30e4e) introduced a HandlerMappingIntrospector API providing unified path matching, eliminating these discrepancies. This fix was already present in the upstream Spring Framework 6.0.13 release that TuxCare onboarded, so the vulnerable code pattern never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:58.947122+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.0.13 is not affected by CVE-2018-11040. The vulnerability concerns automatic JSONP support that was enabled by default in versions 4.3.x prior to 4.3.18 and 5.0.x prior to 5.0.7. JSONP support was deprecated and disabled in those versions, then completely removed in Spring Framework 5.1. The target version (6.0.13) has no JSONP code whatsoever - all vulnerable components (jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, JSONP callback wrapping methods) were removed by upstream vendor commit ac37b678a3 which shipped in the upstream release before TuxCare onboarded version 6.0.13.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.0.13 is not affected by CVE-2018-11040. The vulnerability concerns automatic JSONP support that was enabled by default in versions 4.3.x prior to 4.3.18 and 5.0.x prior to 5.0.7. JSONP support was deprecated and disabled in those versions, then completely removed in Spring Framework 5.1. The target version (6.0.13) has no JSONP code whatsoever - all vulnerable components (jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, JSONP callback wrapping methods) were removed by upstream vendor commit ac37b678a3 which shipped in the upstream release before TuxCare onboarded version 6.0.13.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:11:45.158243+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in spring-framework 6.0.13-tuxcare.7. The vulnerability, which allowed bypassing security constraints via URL-encoded path traversal sequences, duplicate slashes, or backslashes in static resource URLs, was fixed by upstream Spring Framework in March 2018 (commit 0e28bee0f1, SPR-16616). The fix was already present in the upstream 6.0.13 release that TuxCare onboarde...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in spring-framework 6.0.13-tuxcare.7. The vulnerability, which allowed bypassing security constraints via URL-encoded path traversal sequences, duplicate slashes, or backslashes in static resource URLs, was fixed by upstream Spring Framework in March 2018 (commit 0e28bee0f1, SPR-16616). The fix was already present in the upstream 6.0.13 release that TuxCare onboarde..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Version 6.0.13 is not affected by CVE-2018-1257. The fix (commit ff2228fdaf, April 2018) that allows disabling the selector header feature by setting selectorHeaderName to null was already present in the upstream 6.0.0 release and is included in 6.0.13. While the selector is enabled by default, the mitigation mechanism exists and can be activated via configuration, which was the vendor's offici...",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Version 6.0.13 is not affected by CVE-2018-1257. The fix (commit ff2228fdaf, April 2018) that allows disabling the selector header feature by setting selectorHeaderName to null was already present in the upstream 6.0.0 release and is included in 6.0.13. While the selector is enabled by default, the mitigation mechanism exists and can be activated via configuration, which was the vendor's offici..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 is not present in Spring Framework 6.0.13-tuxcare.7. The vulnerability was fixed in upstream commits eaff2c28a7 and aa11721ff0 by Spring Framework maintainer Juergen Hoeller, which were included in the Spring Framework 6.0.13 release that TuxCare onboarded. The fix ensures proper method resolution for annotation lookup on proxy classes, preventing authorization bypass in method security.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is not present in Spring Framework 6.0.13-tuxcare.7. The vulnerability was fixed in upstream commits eaff2c28a7 and aa11721ff0 by Spring Framework maintainer Juergen Hoeller, which were included in the Spring Framework 6.0.13 release that TuxCare onboarded. The fix ensures proper method resolution for annotation lookup on proxy classes, preventing authorization bypass in method security.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:57:19.396013+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version 6.0.13 already contains the upstream fix (commits 0e28bee0f1 and 91b803a231 from March 2018) which was shipped in the upstream release. The fix includes: (1) URL decoding with validation for \"../\" and \"..\\\\\" directory traversal patterns in isInvalidEncodedPath() methods, (2) path norma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version 6.0.13 already contains the upstream fix (commits 0e28bee0f1 and 91b803a231 from March 2018) which was shipped in the upstream release. The fix includes: (1) URL decoding with validation for \"../\" and \"..\\\\\" directory traversal patterns in isInvalidEncodedPath() methods, (2) path norma..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:27:39.447287+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework's multipart boundary generation, where predictable Random() allows attackers to inject crafted boundary strings, causing multipart parsers to treat attacker-controlled content as legitimate message parts (enabling privilege escalation). The upstream fix (commit ab2410c754, March 2018) changed MimeTypeUtils from Random() to SecureRandom(), making boundaries cryptographically unpredictable. Target version 6.0.13 contains this fix - it was shipped in the upstream release before TuxCare onboarding (first TuxCare commit c695ace73d). The fix is authored by rstoyanchev@pivotal.io (upstream), not TuxCare. Current code at MimeTypeUtils.java:408 uses `new SecureRandom()`. All multipart boundary generation in spring-web delegates to this fixed implementation. Verdict: not_affected (upstream fix present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework's multipart boundary generation, where predictable Random() allows attackers to inject crafted boundary strings, causing multipart parsers to treat attacker-controlled content as legitimate message parts (enabling privilege escalation). The upstream fix (commit ab2410c754, March 2018) changed MimeTypeUtils from Random() to SecureRandom(), making boundaries cryptographically unpredictable. Target version 6.0.13 contains this fix - it was shipped in the upstream release before TuxCare onboarding (first TuxCare commit c695ace73d). The fix is authored by rstoyanchev@pivotal.io (upstream), not TuxCare. Current code at MimeTypeUtils.java:408 uses `new SecureRandom()`. All multipart boundary generation in spring-web delegates to this fixed implementation. Verdict: not_affected (upstream fix present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:43:26.013143+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.0.13 is NOT affected by CVE-2018-15756. The fix for this Range header DoS vulnerability was already present in the upstream Spring Framework release that TuxCare onboarded. Both required defenses are implemented: (1) maximum 100 ranges per request validation, and (2) sum of overlapping ranges validation. The fix was authored by the upstream Spring team (rstoyanchev@pivotal.io) in October 2018 and was included in Spring Framework 6.0.13 when it was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.0.13 is NOT affected by CVE-2018-15756. The fix for this Range header DoS vulnerability was already present in the upstream Spring Framework release that TuxCare onboarded. Both required defenses are implemented: (1) maximum 100 ranges per request validation, and (2) sum of overlapping ranges validation. The fix was authored by the upstream Spring team (rstoyanchev@pivotal.io) in October 2018 and was included in Spring Framework 6.0.13 when it was released.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:48:34.408323+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 6.0.13 is not affected by CVE-2021-22060. The vulnerability was fixed in upstream Spring Framework 5.3.14 (December 2021) via commits that sanitize user-controlled input in log statements by replacing newlines and control characters. These upstream fixes were already present in the Spring Framework 6.0.13 release when TuxCare onboarded it in August 2026. The fix is i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.0.13 is not affected by CVE-2021-22060. The vulnerability was fixed in upstream Spring Framework 5.3.14 (December 2021) via commits that sanitize user-controlled input in log statements by replacing newlines and control characters. These upstream fixes were already present in the Spring Framework 6.0.13 release when TuxCare onboarded it in August 2026. The fix is i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:36:05.503461+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) is NOT present in Spring Framework 6.0.13. The fix was shipped in the upstream release before TuxCare onboarded this version. The vulnerability allowed malicious input containing newlines or control characters to inject fake log entries. The upstream fix (commit 99c7608f by Rossen Stoyanchev) sanitizes logged strings by replacing ne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) is NOT present in Spring Framework 6.0.13. The fix was shipped in the upstream release before TuxCare onboarded this version. The vulnerability allowed malicious input containing newlines or control characters to inject fake log entries. The upstream fix (commit 99c7608f by Rossen Stoyanchev) sanitizes logged strings by replacing ne..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:24:00.586682+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.0.13-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI regular-expression comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:166, handler lookup uses an AttributesPreservingRequest wrapper and resolves mappings directly. The class in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:77 contains no CachedResult, cache filter, or cached-URI regex comparison.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI regular-expression comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:166, handler lookup uses an AttributesPreservingRequest wrapper and resolves mappings directly. The class in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:77 contains no CachedResult, cache filter, or cached-URI regex comparison."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T14:01:00.296570+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 6.0.13-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.0.13-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 6.0.13-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.0.13-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T14:01:00.296570+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.0.13-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.0.13-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.0.13-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.0.13-tuxcare.6."
    }
  ]
}