{
  "@id": "urn:uuid:c6c6ec13-4065-4098-acc8-1625da6b92a5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:31:44.282052+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T12:16:57.164290+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in JDK Pattern.compile() (pre-1.6) exploitable through Spring Framework's deserialization of regex patterns. Spring Framework 6.0.15 is not affected because: (1) The vulnerable deserialization code path (readObject method calling Pattern.compile()) was removed in April 2009 via commit 9306d6dbaa, which changed to serialize compiled...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in JDK Pattern.compile() (pre-1.6) exploitable through Spring Framework's deserialization of regex patterns. Spring Framework 6.0.15 is not affected because: (1) The vulnerable deserialization code path (readObject method calling Pattern.compile()) was removed in April 2009 via commit 9306d6dbaa, which changed to serialize compiled..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T17:31:44.282052+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T09:40:00.094131+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.15 is not affected by CVE-2011-2894. The vulnerability required RMI remoting infrastructure (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) that accepted and deserialized untrusted remote data. This entire RPC-style remoting system was deprecated in July 2020 and completely removed in September 2021 (commit 5822f1bf85) before Spring Framework 6.0 was r...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.15 is not affected by CVE-2011-2894. The vulnerability required RMI remoting infrastructure (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) that accepted and deserialized untrusted remote data. This entire RPC-style remoting system was deprecated in July 2020 and completely removed in September 2021 (commit 5822f1bf85) before Spring Framework 6.0 was r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 6.0.15-tuxcare.6. The vulnerability involved improper handling of colons in file paths during path normalization in StringUtils.cleanPath(), allowing directory traversal attacks via crafted URLs. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66 by Rossen Stoyanchev, dated May 15, 2014) was already present in the upstream Spring F...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 6.0.15-tuxcare.6. The vulnerability involved improper handling of colons in file paths during path normalization in StringUtils.cleanPath(), allowing directory traversal attacks via crafted URLs. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66 by Rossen Stoyanchev, dated May 15, 2014) was already present in the upstream Spring F..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T19:06:53.108630+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 concerns predictable session ID generation in Spring Framework 4.1.x before 4.1.5. The vulnerability existed when the SockJS client used AlternativeJdkIdGenerator, which relied on java.util.Random (predictable) after an initial secure seed. The fix, introduced in commit 52b8f34468 by upstream developer Rossen Stoyanchev, replaced it with JdkIdGenerator that calls UUID.randomUUID()...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 concerns predictable session ID generation in Spring Framework 4.1.x before 4.1.5. The vulnerability existed when the SockJS client used AlternativeJdkIdGenerator, which relied on java.util.Random (predictable) after an initial secure seed. The fix, introduced in commit 52b8f34468 by upstream developer Rossen Stoyanchev, replaced it with JdkIdGenerator that calls UUID.randomUUID()..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:59:16.129211+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download vulnerability) is NOT present in Spring Framework 6.0.15. The upstream fix (commit 2bd1daa75e by rstoyanchev@pivotal.io, Oct 4 2015) was already included in the upstream Spring Framework 6.0.15 release when TuxCare onboarded it. The fix added Content-Disposition headers for unsafe file extensions and JSONP callback validation. Target contains the full RFD defense: AbstractMessageConverterMethodProcessor.addContentDispositionHeader() adds \"Content-Disposition: inline;filename=f.txt\" for non-whitelisted extensions (lines 438-476), with SAFE_EXTENSIONS whitelist (lines 82-85). JSONP defense is not needed as JSONP support was completely removed in Spring Framework 6.0+ (commit ac37b678a3, Jun 2018). Verdict: not_affected because the fix was shipped in the upstream release, not applied by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download vulnerability) is NOT present in Spring Framework 6.0.15. The upstream fix (commit 2bd1daa75e by rstoyanchev@pivotal.io, Oct 4 2015) was already included in the upstream Spring Framework 6.0.15 release when TuxCare onboarded it. The fix added Content-Disposition headers for unsafe file extensions and JSONP callback validation. Target contains the full RFD defense: AbstractMessageConverterMethodProcessor.addContentDispositionHeader() adds \"Content-Disposition: inline;filename=f.txt\" for non-whitelisted extensions (lines 438-476), with SAFE_EXTENSIONS whitelist (lines 82-85). JSONP defense is not needed as JSONP support was completely removed in Spring Framework 6.0+ (commit ac37b678a3, Jun 2018). Verdict: not_affected because the fix was shipped in the upstream release, not applied by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. Spring Framework 6.0.15 is not affected by CVE-2016-5007. The vulnerability involved pattern-matching discrepancies between Spring Security's authorization checks and Spring MVC's request routing, allowing attackers to bypass security by crafting URLs with edge-case characters (e.g., trailing spaces). The fix\u2014a HandlerMapping introspection API (MatchableHandlerMapping, HandlerMappingIntrospector, RequestMatchResult)\u2014was introduced in upstream Spring Framework 4.3 (commit a30ab30e4e, April 25, 2016) by Rossen Stoyanchev. This fix has been present in all versions since 4.3, including the upstream 6.0.15 release that TuxCare onboarded. The vulnerable pattern (lack of unified pattern-matching API) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 6.0.15 is not affected by CVE-2016-5007. The vulnerability involved pattern-matching discrepancies between Spring Security's authorization checks and Spring MVC's request routing, allowing attackers to bypass security by crafting URLs with edge-case characters (e.g., trailing spaces). The fix\u2014a HandlerMapping introspection API (MatchableHandlerMapping, HandlerMappingIntrospector, RequestMatchResult)\u2014was introduced in upstream Spring Framework 4.3 (commit a30ab30e4e, April 25, 2016) by Rossen Stoyanchev. This fix has been present in all versions since 4.3, including the upstream 6.0.15 release that TuxCare onboarded. The vulnerable pattern (lack of unified pattern-matching API) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:53:55.157124+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. Spring Framework 6.0.15 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed by upstream Spring Framework in commit ac37b678a3 (June 2018, Spring 5.1+). The target version ships without any JSONP parameter handling code\u2014MappingJackson2JsonView has no jsonpParameterNames field, MappingJacksonValue has no jsonpFunction methods, and AbstractJsonpResponseBodyAdvice doesn't exist. This removal was already present in the 6.0.15 release that TuxCare onboarded, making automatic JSONP enablement impossible. The attack surface described in the CVE (HTTP requests with \"jsonp\"/\"callback\" query parameters triggering cross-domain response wrapping) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.0.15 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed by upstream Spring Framework in commit ac37b678a3 (June 2018, Spring 5.1+). The target version ships without any JSONP parameter handling code\u2014MappingJackson2JsonView has no jsonpParameterNames field, MappingJacksonValue has no jsonpFunction methods, and AbstractJsonpResponseBodyAdvice doesn't exist. This removal was already present in the 6.0.15 release that TuxCare onboarded, making automatic JSONP enablement impossible. The attack surface described in the CVE (HTTP requests with \"jsonp\"/\"callback\" query parameters triggering cross-domain response wrapping) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T01:00:00.493626+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199: Target Spring Framework 6.0.15 is NOT AFFECTED. The vulnerability involved URL path parameters with special encodings (duplicate slashes, backslashes, encoded separators) bypassing security constraints to access protected static resources. All upstream security fixes (SPR-16616, SPR-16296, SPR-16526) from March 2018 are present in the target: processPath() normalizes backslashes ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199: Target Spring Framework 6.0.15 is NOT AFFECTED. The vulnerability involved URL path parameters with special encodings (duplicate slashes, backslashes, encoded separators) bypassing security constraints to access protected static resources. All upstream security fixes (SPR-16616, SPR-16296, SPR-16526) from March 2018 are present in the target: processPath() normalizes backslashes ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T09:05:51.109874+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.15 is not affected by CVE-2018-1257 (STOMP over WebSocket regex DoS). The upstream fix (commit ff2228fdaf by Rossen Stoyanchev, April 2018) was already present in the Spring Framework 6.0.15 release that TuxCare onboarded. The fix addresses the vulnerability by providing a configuration option to disable selector header processing entirely (setSelectorHeaderName(null)) and ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.15 is not affected by CVE-2018-1257 (STOMP over WebSocket regex DoS). The upstream fix (commit ff2228fdaf by Rossen Stoyanchev, April 2018) was already present in the Spring Framework 6.0.15 release that TuxCare onboarded. The fix addresses the vulnerability by providing a configuration option to disable selector header processing entirely (setSelectorHeaderName(null)) and ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. Spring Framework 6.0.15 is not affected by CVE-2018-1258. The authorization bypass vulnerability, which affected version 5.0.5 through incorrect proxy method resolution in security expression evaluation, was fixed by the upstream vendor (Spring/Pivotal) in commits f2e77c292d and 8b051ab06e (April 2018). All three defensive patterns from the patches are present in the target code: (1) AopUtils.getMostSpecificMethod() correctly handles proxy classes without the vulnerable exclusion check, (2) AnnotationMethodMatcher.matches() has the defensive proxy check, and (3) CacheAspectSupport.CacheOperationMetadata correctly resolves targetMethod with proxy handling. The fix was already included in the upstream Spring Framework 6.0.15 release that TuxCare onboarded (commit cda964e4f1), as confirmed by examining the onboarding commit's code state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 6.0.15 is not affected by CVE-2018-1258. The authorization bypass vulnerability, which affected version 5.0.5 through incorrect proxy method resolution in security expression evaluation, was fixed by the upstream vendor (Spring/Pivotal) in commits f2e77c292d and 8b051ab06e (April 2018). All three defensive patterns from the patches are present in the target code: (1) AopUtils.getMostSpecificMethod() correctly handles proxy classes without the vulnerable exclusion check, (2) AnnotationMethodMatcher.matches() has the defensive proxy check, and (3) CacheAspectSupport.CacheOperationMetadata correctly resolves targetMethod with proxy handling. The fix was already included in the upstream Spring Framework 6.0.15 release that TuxCare onboarded (commit cda964e4f1), as confirmed by examining the onboarding commit's code state.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T18:35:35.339720+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.15 is NOT affected by CVE-2018-1271. The vulnerability (directory traversal via backslash-encoded paths on Windows) was fixed in the upstream Spring Framework release before version 6.0.15. The fix checks for both forward-slash (`../`) and backslash (`..\\\\`) directory traversal sequences after URL-decoding paths in static resource handlers. The fix commit (f59ea610df by Jue...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.15 is NOT affected by CVE-2018-1271. The vulnerability (directory traversal via backslash-encoded paths on Windows) was fixed in the upstream Spring Framework release before version 6.0.15. The fix checks for both forward-slash (`../`) and backslash (`..\\\\`) directory traversal sequences after URL-decoding paths in static resource handlers. The fix commit (f59ea610df by Jue..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. CVE-2018-1272 is NOT present in Spring Framework 6.0.15-tuxcare.5. The vulnerability involves predictable multipart boundary generation using java.util.Random, allowing attackers to inject additional multipart sections and potentially achieve privilege escalation. The fix (replacing Random with SecureRandom) was applied by upstream Spring Framework in commit ab2410c754b67902f002bfcc0c3895bd7772d39f (March 2018, issue SPR-16635) and was already present in upstream version 6.0.15 before TuxCare onboarding. The target code at MimeTypeUtils.java:408 uses SecureRandom for cryptographically secure boundary generation, preventing boundary prediction attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in Spring Framework 6.0.15-tuxcare.5. The vulnerability involves predictable multipart boundary generation using java.util.Random, allowing attackers to inject additional multipart sections and potentially achieve privilege escalation. The fix (replacing Random with SecureRandom) was applied by upstream Spring Framework in commit ab2410c754b67902f002bfcc0c3895bd7772d39f (March 2018, issue SPR-16635) and was already present in upstream version 6.0.15 before TuxCare onboarding. The target code at MimeTypeUtils.java:408 uses SecureRandom for cryptographically secure boundary generation, preventing boundary prediction attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:34:53.925887+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. Spring Framework 6.0.15 is NOT affected by CVE-2018-15756. The vulnerability involves DoS attacks via malicious HTTP Range headers with excessive or overlapping ranges. The fix (limiting ranges to 100 max and validating overlap) was introduced by upstream commit 423aa28ed5 on 2018-10-03 and shipped with the upstream Spring Framework 6.0.15 release that TuxCare later onboarded. Both defenses are present in HttpRange.java at lines 48, 136-138, and 185-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.0.15 is NOT affected by CVE-2018-15756. The vulnerability involves DoS attacks via malicious HTTP Range headers with excessive or overlapping ranges. The fix (limiting ranges to 100 max and validating overlap) was introduced by upstream commit 423aa28ed5 on 2018-10-03 and shipped with the upstream Spring Framework 6.0.15 release that TuxCare later onboarded. Both defenses are present in HttpRange.java at lines 48, 136-138, and 185-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-31T20:23:13.698764+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.15 is NOT AFFECTED by CVE-2021-22060 (log injection vulnerability). The upstream release already contained the complete fix: LogFormatUtils.formatValue() replaces both newlines and control characters (\\p{Cc}) with safe placeholders, and this protection is applied to all vulnerable logging locations throughout the codebase. The fix was authored by upstream developer rstoyanc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.15 is NOT AFFECTED by CVE-2021-22060 (log injection vulnerability). The upstream release already contained the complete fix: LogFormatUtils.formatValue() replaces both newlines and control characters (\\p{Cc}) with safe placeholders, and this protection is applied to all vulnerable logging locations throughout the codebase. The fix was authored by upstream developer rstoyanc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-31T21:24:29.858985+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 6.0.15 is not affected by CVE-2021-22096 (log injection vulnerability). The vulnerable code pattern\u2014logging of resource locations without sanitization\u2014is not present in this version. The fix was already included in the upstream Spring Framework 6.0.15 release before TuxCare onboarded it. The upstream fix (commit 05ea991d62 by Rossen Stoyanchev) removed the vulnerable...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.0.15 is not affected by CVE-2021-22096 (log injection vulnerability). The vulnerable code pattern\u2014logging of resource locations without sanitization\u2014is not present in this version. The fix was already included in the upstream Spring Framework 6.0.15 release before TuxCare onboarded it. The upstream fix (commit 05ea991d62 by Rossen Stoyanchev) removed the vulnerable..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-21T16:33:40.639858+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 6.0.15-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 6.0.15-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-21T16:34:00.355906+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.0.15-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.15-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-21T16:34:00.355906+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.0.15-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}