{
  "@id": "urn:uuid:1796d3be-0f2d-4673-8921-d93e91f06424",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:31:44.282052+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2009-1190. The vulnerability required Java deserialization through Spring's RPC-style remoting components (HttpInvoker, RMI remoting, etc.) to trigger pathological regex compilation in JDK < 1.6. Spring Framework 6.0 completely removed all RPC-style remoting infrastructure in commit 5822f1bf85 (Sept 2021) by upstream developer Juergen Hoeller. This...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2009-1190. The vulnerability required Java deserialization through Spring's RPC-style remoting components (HttpInvoker, RMI remoting, etc.) to trigger pathological regex compilation in JDK < 1.6. Spring Framework 6.0 completely removed all RPC-style remoting infrastructure in commit 5822f1bf85 (Sept 2021) by upstream developer Juergen Hoeller. This..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-06T17:31:44.282052+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.0.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T09:42:00.129119+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of proxy classes in RPC-style remoting. The target version (6.0.16-tuxcare.12) is NOT affected because upstream Spring Framework completely removed all vulnerable RPC-style remoting classes (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream, etc.) in commit 5822f1bf85 (2021-09-17) before TuxCare onbo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of proxy classes in RPC-style remoting. The target version (6.0.16-tuxcare.12) is NOT affected because upstream Spring Framework completely removed all vulnerable RPC-style remoting classes (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream, etc.) in commit 5822f1bf85 (2021-09-17) before TuxCare onbo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 (directory traversal vulnerability allowing arbitrary file reads via crafted URLs with colon-separated path segments) is not present in Spring Framework 6.0.16. The vulnerable code pattern (missing validation of path prefixes containing \"/\" characters) was fixed by upstream Spring in May 2014 (commit 8ee4651038). This fix was already included in Spring Framework 6.0.16 when TuxCar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 (directory traversal vulnerability allowing arbitrary file reads via crafted URLs with colon-separated path segments) is not present in Spring Framework 6.0.16. The vulnerable code pattern (missing validation of path prefixes containing \"/\" characters) was fixed by upstream Spring in May 2014 (commit 8ee4651038). This fix was already included in Spring Framework 6.0.16 when TuxCar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T19:08:09.478470+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. Target version 6.0.16 is NOT AFFECTED because the fix (JdkIdGenerator using UUID.randomUUID() for cryptographically secure session IDs) was introduced by upstream Spring in commit 52b8f34468 on January 22, 2015, and shipped in the upstream release that TuxCare onboarded....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. Target version 6.0.16 is NOT AFFECTED because the fix (JdkIdGenerator using UUID.randomUUID() for cryptographically secure session IDs) was introduced by upstream Spring in commit 52b8f34468 on January 22, 2015, and shipped in the upstream release that TuxCare onboarded...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T12:59:16.129211+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. Spring Framework 6.0.16-tuxcare.11 is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). The upstream Spring Framework team fixed this vulnerability in October 2015 (commit 2bd1daa75ee) before version 6.0.16 was released. The fix was already present when TuxCare onboarded this version, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.0.16-tuxcare.11 is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). The upstream Spring Framework team fixed this vulnerability in October 2015 (commit 2bd1daa75ee) before version 6.0.16 was released. The fix was already present when TuxCare onboarded this version, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. CVE-2016-5007 addresses URL pattern matching discrepancies between Spring Security and Spring Framework that could lead to authorization bypass. The fix introduces HandlerMappingIntrospector API (SPR-14321) allowing Spring Security to query Spring MVC's handler mappings using the same pattern matching logic, eliminating the discrepancy. Target version 6.0.16-tuxcare.11 contains the complete defense infrastructure (HandlerMappingIntrospector, MatchableHandlerMapping, RequestMatchResult), introduced in upstream Spring Framework 4.3.1 (April 2016, commit a30ab30e4e by Rossen Stoyanchev @ Pivotal). The fix was present in the upstream 6.0.16 release before TuxCare onboarding (first TuxCare commit eb72a44f81 \"setup\"). Verdict: not_affected - the vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses URL pattern matching discrepancies between Spring Security and Spring Framework that could lead to authorization bypass. The fix introduces HandlerMappingIntrospector API (SPR-14321) allowing Spring Security to query Spring MVC's handler mappings using the same pattern matching logic, eliminating the discrepancy. Target version 6.0.16-tuxcare.11 contains the complete defense infrastructure (HandlerMappingIntrospector, MatchableHandlerMapping, RequestMatchResult), introduced in upstream Spring Framework 4.3.1 (April 2016, commit a30ab30e4e by Rossen Stoyanchev @ Pivotal). The fix was present in the upstream 6.0.16 release before TuxCare onboarding (first TuxCare commit eb72a44f81 \"setup\"). Verdict: not_affected - the vulnerable pattern is not present because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:52:54.438603+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. Spring Framework 6.0.16 is not affected by CVE-2018-11040. The vulnerability concerns JSONP support being automatically enabled in Spring Framework 4.3.x < 4.3.18 and 5.0.x < 5.0.7 when MappingJackson2JsonView was configured. The upstream vendor (Spring/Pivotal) completely removed JSONP support in commit ac37b678a3 (June 7, 2018) before version 6.0.16 was released. This removal was already part of the upstream release when TuxCare onboarded version 6.0.16. The vulnerable code (jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, JSONP query parameter handling) does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.0.16 is not affected by CVE-2018-11040. The vulnerability concerns JSONP support being automatically enabled in Spring Framework 4.3.x < 4.3.18 and 5.0.x < 5.0.7 when MappingJackson2JsonView was configured. The upstream vendor (Spring/Pivotal) completely removed JSONP support in commit ac37b678a3 (June 7, 2018) before version 6.0.16 was released. This removal was already part of the upstream release when TuxCare onboarded version 6.0.16. The vulnerable code (jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, JSONP query parameter handling) does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T00:57:24.924483+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 6.0.16-tuxcare.12. The vulnerability allowed bypassing security constraints through specially encoded URL paths (duplicate slashes, backslashes, percent-encoded separators). The upstream Spring team fixed this in March 2018 (SPR-16616) by adding path normalization (cleanDuplicateSlashes, isInvalidEncodedPath) to ResourceHttpRequestHandler and Pat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 6.0.16-tuxcare.12. The vulnerability allowed bypassing security constraints through specially encoded URL paths (duplicate slashes, backslashes, percent-encoded separators). The upstream Spring team fixed this in March 2018 (SPR-16616) by adding path normalization (cleanDuplicateSlashes, isInvalidEncodedPath) to ResourceHttpRequestHandler and Pat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is not present in Spring Framework 6.0.16. The vulnerability was fixed in the upstream release through commit ff2228fdaf (SPR-16732) authored by Spring developer Rossen Stoyanchev in April 2018. This fix, which allows disabling SpEL selector support to prevent ReDoS attacks, shipped with the upstream Spring Framework 6.0.16 release that TuxCare onboarded. The target repository con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is not present in Spring Framework 6.0.16. The vulnerability was fixed in the upstream release through commit ff2228fdaf (SPR-16732) authored by Spring developer Rossen Stoyanchev in April 2018. This fix, which allows disabling SpEL selector support to prevent ReDoS attacks, shipped with the upstream Spring Framework 6.0.16 release that TuxCare onboarded. The target repository con..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. CVE-2018-1258 authorization bypass vulnerability is not present in Spring Framework 6.0.16-tuxcare.12. The upstream fixes (commits aa11721ff0f and eaff2c28a78 by Juergen Hoeller) that correctly resolve target methods for proxy classes were already included in the Spring Framework 6.0.16 upstream release, before TuxCare's maintenance began. All fix components are verified present: AopUtils.getMostSpecificMethod() processes proxy classes correctly, CacheAspectSupport and ApplicationListenerMethodAdapter resolve targetMethod upfront with proper proxy handling, and AnnotationMethodMatcher includes early-return logic for proxy classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 authorization bypass vulnerability is not present in Spring Framework 6.0.16-tuxcare.12. The upstream fixes (commits aa11721ff0f and eaff2c28a78 by Juergen Hoeller) that correctly resolve target methods for proxy classes were already included in the Spring Framework 6.0.16 upstream release, before TuxCare's maintenance began. All fix components are verified present: AopUtils.getMostSpecificMethod() processes proxy classes correctly, CacheAspectSupport and ApplicationListenerMethodAdapter resolve targetMethod upfront with proper proxy handling, and AnnotationMethodMatcher includes early-return logic for proxy classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2018-1271. All defenses introduced by the security patches are present in the target code. The vulnerability allowed directory traversal via specially crafted URLs with encoded path sequences, backslashes, or duplicate slashes when serving static resources on Windows. The target contains complete protections: (1) processPath() normalizes backslashe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2018-1271. All defenses introduced by the security patches are present in the target code. The vulnerability allowed directory traversal via specially crafted URLs with encoded path sequences, backslashes, or duplicate slashes when serving static resources on Windows. The target contains complete protections: (1) processPath() normalizes backslashe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. Spring Framework 6.0.16 is not affected by CVE-2018-1272. The vulnerability required predictable multipart boundary generation using Random(), but version 6.0.16 already uses SecureRandom() for boundary generation. The fix (commit ab2410c754 from March 2018 by upstream author rstoyanchev@pivotal.io) was integrated into the upstream Spring Framework v6.0.16 release (January 2024) before TuxCare onboarding. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.0.16 is not affected by CVE-2018-1272. The vulnerability required predictable multipart boundary generation using Random(), but version 6.0.16 already uses SecureRandom() for boundary generation. The fix (commit ab2410c754 from March 2018 by upstream author rstoyanchev@pivotal.io) was integrated into the upstream Spring Framework v6.0.16 release (January 2024) before TuxCare onboarding. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:34:53.925887+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. Spring Framework 6.0.16 is not affected by CVE-2018-15756. The upstream fix that limits HTTP range requests to 100 maximum and validates that the sum of requested bytes is less than the resource length was already present in the Spring Framework 6.0.16 release. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 423aa28ed5 on October 3, 2018, addressing issue SPR-17318. When TuxCare onboarded version 6.0.16 via the setup commit eb72a44f81, the fix was already present in the codebase. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.0.16 is not affected by CVE-2018-15756. The upstream fix that limits HTTP range requests to 100 maximum and validates that the sum of requested bytes is less than the resource length was already present in the Spring Framework 6.0.16 release. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 423aa28ed5 on October 3, 2018, addressing issue SPR-17318. When TuxCare onboarded version 6.0.16 via the setup commit eb72a44f81, the fix was already present in the codebase. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2021-22060 (log injection via newlines/control characters). The upstream vendor (Rossen Stoyanchev, VMware) implemented the fix in December 2021, which was included in the Spring Framework 6.0.16 release that TuxCare onboarded. The fix consists of: (1) LogFormatUtils.formatValue() sanitizing user-controlled strings by replacing newlines with &lt;EO...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2021-22060 (log injection via newlines/control characters). The upstream vendor (Rossen Stoyanchev, VMware) implemented the fix in December 2021, which was included in the Spring Framework 6.0.16 release that TuxCare onboarded. The fix consists of: (1) LogFormatUtils.formatValue() sanitizing user-controlled strings by replacing newlines with &lt;EO..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection vulnerability) is not present in Spring Framework 6.0.16. The upstream fix was already included in the 6.0.16 release that TuxCare onboarded. The fix adds LogFormatUtils.formatValue() which sanitizes newlines and control characters before logging user-controlled input, preventing log injection attacks. All locations where user request paths are logged use this sani...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection vulnerability) is not present in Spring Framework 6.0.16. The upstream fix was already included in the 6.0.16 release that TuxCare onboarded. The fix adds LogFormatUtils.formatValue() which sanitizes newlines and control characters before logging user-controlled input, preventing log injection attacks. All locations where user request paths are logged use this sani..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-core. CVE-2024-22233 is NOT present in Spring Framework 6.0.16-tuxcare.12. Both vulnerability patterns described in the CVE have been fixed by upstream commits that were already included in the Spring Framework 6.0.16 release before TuxCare onboarded it. The fixes address: (1) unhandled exceptions from malformed forwarded headers in ForwardedHeaderFilter, and (2) PatternSyntaxException from regex metacharacters in request URIs in HandlerMappingIntrospector. Both defensive mechanisms are present and functional in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 is NOT present in Spring Framework 6.0.16-tuxcare.12. Both vulnerability patterns described in the CVE have been fixed by upstream commits that were already included in the Spring Framework 6.0.16 release before TuxCare onboarded it. The fixes address: (1) unhandled exceptions from malformed forwarded headers in ForwardedHeaderFilter, and (2) PatternSyntaxException from regex metacharacters in request URIs in HandlerMappingIntrospector. Both defensive mechanisms are present and functional in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}