{
  "@id": "urn:uuid:773982d9-d82d-4f82-b7d3-cf76642d6a9e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 53,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:32:10.656819+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:19:00.095877+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.14 is not affected by CVE-2009-1190. While vulnerable classes (JdkRegexpMethodPointcut, UriTemplate) that are Serializable and contain Pattern fields still exist in the codebase, the attack vector\u2014Java deserialization of objects containing malicious regex patterns\u2014is not present in Spring Framework 6.0.14. Spring Remoting (deprecated in 2020) was the primary vector for Java...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.14 is not affected by CVE-2009-1190. While vulnerable classes (JdkRegexpMethodPointcut, UriTemplate) that are Serializable and contain Pattern fields still exist in the codebase, the attack vector\u2014Java deserialization of objects containing malicious regex patterns\u2014is not present in Spring Framework 6.0.14. Spring Remoting (deprecated in 2020) was the primary vector for Java..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:32:10.656819+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 6.0.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 6.0.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:43:37.074687+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.14-tuxcare.3 is not affected by CVE-2011-2894. The vulnerability (arbitrary code execution via deserialization of malicious proxy classes) was fixed by upstream Spring in commit 7d8aa05c407 (July 2011) by adding an acceptProxyClasses flag to ConfigurableObjectInputStream that rejects proxy class deserialization when disabled. This fix was already present in the upstream Spr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.14-tuxcare.3 is not affected by CVE-2011-2894. The vulnerability (arbitrary code execution via deserialization of malicious proxy classes) was fixed by upstream Spring in commit 7d8aa05c407 (July 2011) by adding an acceptProxyClasses flag to ConfigurableObjectInputStream that rejects proxy class deserialization when disabled. This fix was already present in the upstream Spr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5, exploitable via crafted URLs with embedded colons that bypass path normalization (e.g., /a/:b/../../file). The target version 6.0.14 is not affected because the upstream vendor (Spring) fixed this vulnerability in May 2014 with commit 8ee4651038, which has been present in all releases...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5, exploitable via crafted URLs with embedded colons that bypass path normalization (e.g., /a/:b/../../file). The target version 6.0.14 is not affected because the upstream vendor (Spring) fixed this vulnerability in May 2014 with commit 8ee4651038, which has been present in all releases..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:08:09.478470+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 concerns predictable session ID generation in the SockJS Java client (Spring Framework 4.1.x before 4.1.5). The vulnerability was fixed in upstream Spring Framework 4.1.5 by introducing JdkIdGenerator, which uses UUID.randomUUID() for cryptographically secure session IDs. The target repository (Spring Framework 6.0.14) already contains this fix, as it was present in the upstream r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 concerns predictable session ID generation in the SockJS Java client (Spring Framework 4.1.x before 4.1.5). The vulnerability was fixed in upstream Spring Framework 4.1.5 by introducing JdkIdGenerator, which uses UUID.randomUUID() for cryptographically secure session IDs. The target repository (Spring Framework 6.0.14) already contains this fix, as it was present in the upstream r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:59:16.129211+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 RFD (Reflected File Download) vulnerability is NOT present in Spring Framework 6.0.14. The upstream fix was introduced in October 2015 (commit 2bd1daa75e, included in v4.2.2.RELEASE) and is present in all subsequent releases including 6.0.14. The fix adds Content-Disposition headers with safe filenames when unsafe file extensions are detected in URL paths or path parameters, preventing browsers from using attacker-controlled extensions. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 RFD (Reflected File Download) vulnerability is NOT present in Spring Framework 6.0.14. The upstream fix was introduced in October 2015 (commit 2bd1daa75e, included in v4.2.2.RELEASE) and is present in all subsequent releases including 6.0.14. The fix adds Content-Disposition headers with safe filenames when unsafe file extensions are detected in URL paths or path parameters, preventing browsers from using attacker-controlled extensions. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.0.14 is NOT affected by CVE-2016-5007. The vulnerability concerned pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass. The fix (providing the MatchableHandlerMapping API and HandlerMappingIntrospector for unified pattern matching) was introduced in upstream Spring Framework 4.3.1.RELEASE (April 2016) via commit a30ab30e4e9ae021fdda04e9abfc228476b846b5. Version 6.0.14 inherits this fix from the upstream release - it was already present before any TuxCare modifications. The vulnerable code pattern (lack of unified pattern matching API) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 6.0.14 is NOT affected by CVE-2016-5007. The vulnerability concerned pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass. The fix (providing the MatchableHandlerMapping API and HandlerMappingIntrospector for unified pattern matching) was introduced in upstream Spring Framework 4.3.1.RELEASE (April 2016) via commit a30ab30e4e9ae021fdda04e9abfc228476b846b5. Version 6.0.14 inherits this fix from the upstream release - it was already present before any TuxCare modifications. The vulnerable code pattern (lack of unified pattern matching API) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:53:55.157124+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. CVE-2018-11040 does not affect Spring Framework 6.0.14. The vulnerable JSONP support code was completely removed from Spring Framework in version 5.1.0 (June 2018) by the upstream Spring team, long before the 6.0.14 release. The removal commit (ac37b678a3) is present in the target's ancestry and was part of the upstream release that TuxCare onboarded. No JSONP-related classes, methods, or query parameter processing exists in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 does not affect Spring Framework 6.0.14. The vulnerable JSONP support code was completely removed from Spring Framework in version 5.1.0 (June 2018) by the upstream Spring team, long before the 6.0.14 release. The removal commit (ac37b678a3) is present in the target's ancestry and was part of the upstream release that TuxCare onboarded. No JSONP-related classes, methods, or query parameter processing exists in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:01:00.250740+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.14 is not affected by CVE-2018-1199. The vulnerability affected versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The target version (6.0.14, released in 2023) contains all the upstream fixes that were applied in March 2018 (commits 0e28bee0f1, 91b803a231, 6d26e61ac7, and related). The fixes include: (1) UrlPathHelper.removeSemicolonContent enabled by default to strip pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.14 is not affected by CVE-2018-1199. The vulnerability affected versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The target version (6.0.14, released in 2023) contains all the upstream fixes that were applied in March 2018 (commits 0e28bee0f1, 91b803a231, 6d26e61ac7, and related). The fixes include: (1) UrlPathHelper.removeSemicolonContent enabled by default to strip pa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T09:10:31.335583+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 fix is present in Spring Framework 6.0.14. The vulnerability involves regex DoS via crafted SpEL selector expressions in STOMP WebSocket subscriptions. The upstream fix (commit ff2228fdaf, April 2018, by rstoyanchev@pivotal.io) adds the ability to disable the selector feature by setting selectorHeaderName to null, preventing malicious expression parsing. This fix was already in th...",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 fix is present in Spring Framework 6.0.14. The vulnerability involves regex DoS via crafted SpEL selector expressions in STOMP WebSocket subscriptions. The upstream fix (commit ff2228fdaf, April 2018, by rstoyanchev@pivotal.io) adds the ability to disable the selector feature by setting selectorHeaderName to null, preventing malicious expression parsing. This fix was already in th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. CVE-2018-1258 is not present in Spring Framework 6.0.14. The vulnerability, which allowed authorization bypass when using method security with Spring Security due to incorrect method resolution on JDK dynamic proxies (especially proxy-of-proxy scenarios), was fixed by upstream Spring Framework maintainer Juergen Hoeller on April 27, 2018. The fix commits (aa11721ff0 and eaff2c28a7) are present in the target's ancestry and were included in the upstream 6.0.14 release before TuxCare onboarded it. The vulnerable pattern (skipping proxy class resolution in AopUtils.getMostSpecificMethod and missing early-exit in AnnotationMethodMatcher) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is not present in Spring Framework 6.0.14. The vulnerability, which allowed authorization bypass when using method security with Spring Security due to incorrect method resolution on JDK dynamic proxies (especially proxy-of-proxy scenarios), was fixed by upstream Spring Framework maintainer Juergen Hoeller on April 27, 2018. The fix commits (aa11721ff0 and eaff2c28a7) are present in the target's ancestry and were included in the upstream 6.0.14 release before TuxCare onboarded it. The vulnerable pattern (skipping proxy class resolution in AopUtils.getMostSpecificMethod and missing early-exit in AnnotationMethodMatcher) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:37:22.146734+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 6.0.14. The vulnerability allowed directory traversal on Windows via URL-encoded backslashes (..%5C) because the original code only checked for forward-slash separators (../) after URL decoding. The fix was applied in March 2018 (commit 695bf2961f) by upstream Spring developer Juergen Hoeller, adding checks for BOTH \"../\" AND \"..\\\\\" patterns in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 6.0.14. The vulnerability allowed directory traversal on Windows via URL-encoded backslashes (..%5C) because the original code only checked for forward-slash separators (../) after URL decoding. The fix was applied in March 2018 (commit 695bf2961f) by upstream Spring developer Juergen Hoeller, adding checks for BOTH \"../\" AND \"..\\\\\" patterns in t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.0.14 is not affected by CVE-2018-1272. The vulnerability (predictable multipart boundary generation using insecure Random) was fixed in upstream Spring 5.0.5 and 4.3.15 (March 2018). Version 6.0.14, released much later, already contains the upstream fix that replaces Random with SecureRandom for boundary generation. The fix commit (847202c8f8) by upstream developer jhoeller@pivotal.io is present in the v6.0.14 tag and shipped before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.0.14 is not affected by CVE-2018-1272. The vulnerability (predictable multipart boundary generation using insecure Random) was fixed in upstream Spring 5.0.5 and 4.3.15 (March 2018). Version 6.0.14, released much later, already contains the upstream fix that replaces Random with SecureRandom for boundary generation. The fix commit (847202c8f8) by upstream developer jhoeller@pivotal.io is present in the v6.0.14 tag and shipped before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:34:53.925887+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 is not present in Spring Framework 6.0.14. The vulnerability involved DoS attacks through malicious HTTP Range headers with excessive range counts or overlapping ranges. The upstream vendor (VMware/Pivotal) fixed this in October 2018 by adding two defenses: (1) limiting ranges to 100 maximum, and (2) validating that the sum of range lengths doesn't exceed resource length. This fix (commit 423aa28ed5) was already present in the upstream Spring Framework 6.0.14 release that TuxCare onboarded, as confirmed by the fix commit predating the first TuxCare commit (3cd3eb5397) in the branch history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is not present in Spring Framework 6.0.14. The vulnerability involved DoS attacks through malicious HTTP Range headers with excessive range counts or overlapping ranges. The upstream vendor (VMware/Pivotal) fixed this in October 2018 by adding two defenses: (1) limiting ranges to 100 maximum, and (2) validating that the sum of range lengths doesn't exceed resource length. This fix (commit 423aa28ed5) was already present in the upstream Spring Framework 6.0.14 release that TuxCare onboarded, as confirmed by the fix commit predating the first TuxCare commit (3cd3eb5397) in the branch history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:23:13.698764+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 6.0.14 is not affected by CVE-2021-22060 (log injection vulnerability). The vulnerability was fixed upstream in Spring Framework 5.3.14 (December 2021) by commit 99c7608f, which introduced control character and newline sanitization in LogFormatUtils and applied it across multiple logging locations. This fix was already present in the upstream release 6.0.14 that TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.0.14 is not affected by CVE-2021-22060 (log injection vulnerability). The vulnerability was fixed upstream in Spring Framework 5.3.14 (December 2021) by commit 99c7608f, which introduced control character and newline sanitization in LogFormatUtils and applied it across multiple logging locations. This fix was already present in the upstream release 6.0.14 that TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T21:23:55.038712+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.0.14-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.14 is not affected by CVE-2021-22096 (log injection vulnerability). The upstream fix (commit 99c7608ffe726fea4d6a1dce30005a8273cb305e by Rossen Stoyanchev) was already present in the upstream release before TuxCare onboarding. LogFormatUtils.formatValue() sanitizes all user-controlled input before logging by replacing newlines with \"<EOL>\" and control characters with \"?\", p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.14 is not affected by CVE-2021-22096 (log injection vulnerability). The upstream fix (commit 99c7608ffe726fea4d6a1dce30005a8273cb305e by Rossen Stoyanchev) was already present in the upstream release before TuxCare onboarding. LogFormatUtils.formatValue() sanitizes all user-controlled input before logging by replacing newlines with \"<EOL>\" and control characters with \"?\", p..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 6.0.14-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 6.0.14-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T13:11:00.236721+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 6.0.14-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.0.14-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 6.0.14-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.0.14-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.14-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T13:12:17.766673+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.0.14-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.0.14-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.0.14-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.0.14-tuxcare.2."
    }
  ]
}