{
  "@id": "urn:uuid:ac171eea-a7a2-47da-bdff-c16d810cf0a0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:30:26.757723+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:09:48.333130+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile() that causes CPU exhaustion when processing regex patterns with multiple optional groups. Spring Framework 6.1.15 contains unvalidated Pattern.compile() calls in StringToPatternConverter (spring-core) and PatternEditor (spring-beans), both registered by default. However, these code paths are NOT ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile() that causes CPU exhaustion when processing regex patterns with multiple optional groups. Spring Framework 6.1.15 contains unvalidated Pattern.compile() calls in StringToPatternConverter (spring-core) and PatternEditor (spring-beans), both registered by default. However, these code paths are NOT ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:30:26.757723+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:38:00.146680+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.15 is NOT AFFECTED by CVE-2011-2894. The vulnerability (deserialization of untrusted proxy classes enabling RCE) was fixed by upstream Spring in July 2011 via commit 7d8aa05c40, which added the acceptProxyClasses defense to ConfigurableObjectInputStream. This fix shipped in all Spring Framework releases since 3.0.6+ and is present in 6.1.15. Additionally, the vulnerable RMI...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.15 is NOT AFFECTED by CVE-2011-2894. The vulnerability (deserialization of untrusted proxy classes enabling RCE) was fixed by upstream Spring in July 2011 via commit 7d8aa05c40, which added the acceptProxyClasses defense to ConfigurableObjectInputStream. This fix shipped in all Spring Framework releases since 3.0.6+ and is present in 6.1.15. Additionally, the vulnerable RMI..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.1.15-tuxcare.6. The upstream vendor fix (commit 8ee4651038 from May 2014, SPR-11793) was already included in the Spring Framework 6.1.15 release that TuxCare onboarded. The fix adds validation to StringUtils.cleanPath() that rejects URL prefixes containing path separators (lines 732-734), preventing malformed p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.1.15-tuxcare.6. The upstream vendor fix (commit 8ee4651038 from May 2014, SPR-11793) was already included in the Spring Framework 6.1.15 release that TuxCare onboarded. The fix adds validation to StringUtils.cleanPath() that rejects URL prefixes containing path separators (lines 732-734), preventing malformed p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:46.375124+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (a weak PRNG seeded once with SecureRandom, then using java.util.Random for all subsequent UUIDs). The target version 6.1.15 contains the upstream fix (commit 52b8f34468, authored by Rossen Stoyanchev on 2015-01-22) which replaced AlternativeJdkIdG...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (a weak PRNG seeded once with SecureRandom, then using java.util.Random for all subsequent UUIDs). The target version 6.1.15 contains the upstream fix (commit 52b8f34468, authored by Rossen Stoyanchev on 2015-01-22) which replaced AlternativeJdkIdG..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.15-tuxcare.6 is not affected by CVE-2015-5211 (Reflected File Download attack). The vulnerable JSONP functionality that the CVE targets was completely removed from Spring Framework in 2018 (commit ac37b678a3), years before version 6.1.15 was released. The original RFD fix was applied by upstream in 2015 (commit 2bd1daa75e), and subsequently JSONP support was entirely removed as CORS became the preferred cross-domain solution. The attack vector (malicious URL with batch script extension triggering JSONP response) cannot be exploited because JSONP functionality does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.1.15-tuxcare.6 is not affected by CVE-2015-5211 (Reflected File Download attack). The vulnerable JSONP functionality that the CVE targets was completely removed from Spring Framework in 2018 (commit ac37b678a3), years before version 6.1.15 was released. The original RFD fix was applied by upstream in 2015 (commit 2bd1daa75e), and subsequently JSONP support was entirely removed as CORS became the preferred cross-domain solution. The attack vector (malicious URL with batch script extension triggering JSONP response) cannot be exploited because JSONP functionality does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:56.260651+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.15 is NOT affected by CVE-2016-5007. The fix (HandlerMapping introspection API including MatchableHandlerMapping interface, HandlerMappingIntrospector class, and match() method implementations) was introduced in upstream Spring Framework 4.3.1 (April 2016) and is present in version 6.1.15. The fix was part of the upstream release that TuxCare onboarded, not a separate backport. The vulnerable pattern (missing standardized API for pattern matching introspection) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 6.1.15 is NOT affected by CVE-2016-5007. The fix (HandlerMapping introspection API including MatchableHandlerMapping interface, HandlerMappingIntrospector class, and match() method implementations) was introduced in upstream Spring Framework 4.3.1 (April 2016) and is present in version 6.1.15. The fix was part of the upstream release that TuxCare onboarded, not a separate backport. The vulnerable pattern (missing standardized API for pattern matching introspection) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:51:14.737145+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.15 is not affected by CVE-2018-11040. The vulnerability concerns JSONP (JSON with Padding) support that enabled cross-domain requests through callback parameters (\"jsonp\" and \"callback\") in MappingJackson2JsonView and AbstractJsonpResponseBodyAdvice. This entire feature was completely removed from Spring Framework in upstream commit ac37b678a3 (June 2018) by sdeleuze@pivotal.io, well before Spring Framework 6.x was released. The target version contains no JSONP-related code, classes, or callback parameter processing logic. The CVE affected versions 4.3.x prior to 4.3.18 and 5.0.x prior to 5.0.7; the target version 6.1.15 is far beyond this range and never contained the vulnerable code pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.1.15 is not affected by CVE-2018-11040. The vulnerability concerns JSONP (JSON with Padding) support that enabled cross-domain requests through callback parameters (\"jsonp\" and \"callback\") in MappingJackson2JsonView and AbstractJsonpResponseBodyAdvice. This entire feature was completely removed from Spring Framework in upstream commit ac37b678a3 (June 2018) by sdeleuze@pivotal.io, well before Spring Framework 6.x was released. The target version contains no JSONP-related code, classes, or callback parameter processing logic. The CVE affected versions 4.3.x prior to 4.3.18 and 5.0.x prior to 5.0.7; the target version 6.1.15 is far beyond this range and never contained the vulnerable code pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T00:53:00.082543+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.15 is NOT affected by CVE-2018-1199. The vulnerability (URL path parameter manipulation to bypass security constraints) was fixed in upstream Spring Framework before version 6.1.15 was released. The fix includes comprehensive path normalization (backslash-to-slash conversion, duplicate slash removal, URL decoding with re-validation, and path traversal detection) in Resource...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.15 is NOT affected by CVE-2018-1199. The vulnerability (URL path parameter manipulation to bypass security constraints) was fixed in upstream Spring Framework before version 6.1.15 was released. The fix includes comprehensive path normalization (backslash-to-slash conversion, duplicate slash removal, URL decoding with re-validation, and path traversal detection) in Resource..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T09:01:17.494754+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.1.15. The vulnerability (malicious SpEL expressions in STOMP subscription selector headers causing DoS) was fixed upstream in Spring Framework 6.1 by disabling selector header processing by default. Commit 5bc80fc094 (Sam Brannen, June 2023) changed the default from selector header enabled to null/disabled. This fix was already present in the ups...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.1.15. The vulnerability (malicious SpEL expressions in STOMP subscription selector headers causing DoS) was fixed upstream in Spring Framework 6.1 by disabling selector header processing by default. Commit 5bc80fc094 (Sam Brannen, June 2023) changed the default from selector header enabled to null/disabled. This fix was already present in the ups..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. CVE-2018-1258 (authorization bypass via proxy method resolution) is NOT present in Spring Framework 6.1.15-tuxcare.6. All required fixes are present in the target code. The vulnerability was fixed in upstream Spring Framework v5.0.6.RELEASE (April 2018) by Juergen Hoeller, and the target version 6.1.15 (released 2024) inherited the fix from the upstream release before TuxCare onboarding. The vulnerable pattern (getMostSpecificMethod excluding proxy classes from annotation lookup) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 (authorization bypass via proxy method resolution) is NOT present in Spring Framework 6.1.15-tuxcare.6. All required fixes are present in the target code. The vulnerability was fixed in upstream Spring Framework v5.0.6.RELEASE (April 2018) by Juergen Hoeller, and the target version 6.1.15 (released 2024) inherited the fix from the upstream release before TuxCare onboarding. The vulnerable pattern (getMostSpecificMethod excluding proxy classes from annotation lookup) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:27:28.153921+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 6.1.15 is not affected by CVE-2018-1271. The vulnerability affects versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version already contains the upstream fixes (commits 91b803a231, 0e28bee0f1, etc.) that were shipped in the upstream Spring Framework 6.1.15 release. The fixes add isInvalidEncodedPath() validation that checks for both \"../\" and \"..\\\\\" in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.1.15 is not affected by CVE-2018-1271. The vulnerability affects versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version already contains the upstream fixes (commits 91b803a231, 0e28bee0f1, etc.) that were shipped in the upstream Spring Framework 6.1.15 release. The fixes add isInvalidEncodedPath() validation that checks for both \"../\" and \"..\\\\\" in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.15 is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak Random, enabling attackers to inject malicious parts into forwarded multipart requests and modify security-sensitive parameters. The target uses SecureRandom for boundary generation (MimeTypeUtils.java line 408), making boundaries cryptographically unpredictable. The fix was shipped in upstream Spring Framework and was already present when TuxCare onboarded version 6.1.15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.1.15 is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak Random, enabling attackers to inject malicious parts into forwarded multipart requests and modify security-sensitive parameters. The target uses SecureRandom for boundary generation (MimeTypeUtils.java line 408), making boundaries cryptographically unpredictable. The fix was shipped in upstream Spring Framework and was already present when TuxCare onboarded version 6.1.15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:59.098532+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 affects Spring Framework versions 5.1, 5.0.x prior to 5.0.10, 4.3.x prior to 4.3.20, and older 4.2.x versions. The target version 6.1.15 is far beyond the affected range. The fix (MAX_RANGES=100 limit and sum-of-ranges validation) was introduced by upstream commit 423aa28ed58 by Rossen Stoyanchev in October 2018 and was already present in the upstream Spring Framework 6.1.15 release when TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 affects Spring Framework versions 5.1, 5.0.x prior to 5.0.10, 4.3.x prior to 4.3.20, and older 4.2.x versions. The target version 6.1.15 is far beyond the affected range. The fix (MAX_RANGES=100 limit and sum-of-ranges validation) was introduced by upstream commit 423aa28ed58 by Rossen Stoyanchev in October 2018 and was already present in the upstream Spring Framework 6.1.15 release when TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:16:05.248593+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 is NOT present in Spring Framework 6.1.15-tuxcare.6. The vulnerability (log injection via newline and control characters) was fixed in the upstream Spring Framework release before TuxCare onboarded version 6.1.15. The fix commit 99c7608ffe7 by Rossen Stoyanchev (VMware) introduced LogFormatUtils.formatValue() that sanitizes user input by replacing newlines with <EOL> and control ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 is NOT present in Spring Framework 6.1.15-tuxcare.6. The vulnerability (log injection via newline and control characters) was fixed in the upstream Spring Framework release before TuxCare onboarded version 6.1.15. The fix commit 99c7608ffe7 by Rossen Stoyanchev (VMware) introduced LogFormatUtils.formatValue() that sanitizes user input by replacing newlines with <EOL> and control ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T21:17:28.275199+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) does not affect Spring Framework 6.1.15. The vulnerability was fixed in upstream commit 99c7608f by Rossen Stoyanchev, which added sanitization patterns (NEWLINE_PATTERN, CONTROL_CHARACTER_PATTERN) to LogFormatUtils.java and applied LogFormatUtils.formatValue() to all logging sites where user-controlled input appears. This fix was al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) does not affect Spring Framework 6.1.15. The vulnerability was fixed in upstream commit 99c7608f by Rossen Stoyanchev, which added sanitization patterns (NEWLINE_PATTERN, CONTROL_CHARACTER_PATTERN) to LogFormatUtils.java and applied LogFormatUtils.formatValue() to all logging sites where user-controlled input appears. This fix was al..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.1.15-tuxcare.1 of org.springframework:spring-core. CVE-2024-22233 affects Spring Framework 6.0.15 and 6.1.2 via two DoS vectors: (1) malformed forwarded headers causing uncaught exceptions in ForwardedHeaderFilter, and (2) URIs with regex metacharacters triggering PatternSyntaxException in HandlerMappingIntrospector. The target (Spring Framework 6.1.15-tuxcare.6) is NOT AFFECTED because both upstream fixes were already present in the 6.1.15 release onboarded by TuxCare. Fix commits 4afac17e58 (Dec 2023) and 7c9307e970 (Jan 2024) by brian.clozel@broadcom.com are ancestors of the onboarding commit dad287df (July 2026/likely 2024-2025). The fixes add try-catch error handling returning HTTP 400 for invalid headers, and replace String.matches() with String.equals() to prevent regex interpretation. Both defenses remain intact in HEAD with no regressions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 affects Spring Framework 6.0.15 and 6.1.2 via two DoS vectors: (1) malformed forwarded headers causing uncaught exceptions in ForwardedHeaderFilter, and (2) URIs with regex metacharacters triggering PatternSyntaxException in HandlerMappingIntrospector. The target (Spring Framework 6.1.15-tuxcare.6) is NOT AFFECTED because both upstream fixes were already present in the 6.1.15 release onboarded by TuxCare. Fix commits 4afac17e58 (Dec 2023) and 7c9307e970 (Jan 2024) by brian.clozel@broadcom.com are ancestors of the onboarding commit dad287df (July 2026/likely 2024-2025). The fixes add try-catch error handling returning HTTP 400 for invalid headers, and replace String.matches() with String.equals() to prevent regex interpretation. Both defenses remain intact in HEAD with no regressions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 6.1.15-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.15-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 6.1.15-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.15-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.1.15-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.15-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.1.15-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.15-tuxcare.4."
    }
  ]
}