{
  "@id": "urn:uuid:808ce6b8-379f-4cfd-a34e-6fe4aa89f141",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 48,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:40:50.837478+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T13:11:00.163144+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes a ReDoS vulnerability via deserialization of JdkRegexpMethodPointcut objects with pathological regex patterns. Spring Framework 6.1.18 is NOT AFFECTED because Spring 6.0+ removed all serialization-based remoting protocols (RMI, HTTP Invoker) in September 2021 (commit 5822f1bf85). While the vulnerable code pattern (Pattern.compile without validation in JdkRegexpMethodPoin...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes a ReDoS vulnerability via deserialization of JdkRegexpMethodPointcut objects with pathological regex patterns. Spring Framework 6.1.18 is NOT AFFECTED because Spring 6.0+ removed all serialization-based remoting protocols (RMI, HTTP Invoker) in September 2021 (commit 5822f1bf85). While the vulnerable code pattern (Pattern.compile without validation in JdkRegexpMethodPoin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:50.837478+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.18 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.18 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:54:00.051000+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.18 is not affected by CVE-2011-2894. The vulnerability was fixed by upstream Spring in 2011 (commit 7d8aa05c40 by jhoeller@vmware.com), and that fix was already present in the upstream 6.1.18 release that TuxCare onboarded. Additionally, the vulnerable RMI remoting infrastructure (CodebaseAwareObjectInputStream, RemoteInvocationSerializingExporter) was completely removed fr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.18 is not affected by CVE-2011-2894. The vulnerability was fixed by upstream Spring in 2011 (commit 7d8aa05c40 by jhoeller@vmware.com), and that fix was already present in the upstream 6.1.18 release that TuxCare onboarded. Additionally, the vulnerable RMI remoting infrastructure (CodebaseAwareObjectInputStream, RemoteInvocationSerializingExporter) was completely removed fr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.1.18. The upstream fix (commit 8ee465103850 from May 2014) was already included in the Spring Framework 6.1.18 release when TuxCare onboarded it. The fix adds validation in StringUtils.cleanPath() to check if a colon-delimited prefix contains a forward slash, and if so, discards the prefix to prevent path manip...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.1.18. The upstream fix (commit 8ee465103850 from May 2014) was already included in the Spring Framework 6.1.18 release when TuxCare onboarded it. The fix adds validation in StringUtils.cleanPath() to check if a colon-delimited prefix contains a forward slash, and if so, discards the prefix to prevent path manip..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:20:00.402348+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target (Spring Framework 6.1.18-tuxcare.2) is not affected because the vulnerability was fixed upstream in commit 52b8f34468 (Jan 2015) by switching from AlternativeJdkIdGenerator (which used SecureRandom only for the initial seed, producing predictable IDs) to JdkId...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target (Spring Framework 6.1.18-tuxcare.2) is not affected because the vulnerability was fixed upstream in commit 52b8f34468 (Jan 2015) by switching from AlternativeJdkIdGenerator (which used SecureRandom only for the initial seed, producing predictable IDs) to JdkId..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download vulnerability) is NOT present in Spring Framework 6.1.18. The fix was already included in the upstream Spring Framework release before TuxCare onboarded it. The vulnerability allowed attackers to craft URLs with malicious file extensions (e.g., .bat, .cmd) causing browsers to download and potentially execute response content as scripts. The upstream fix (commit 2bd1daa75e from October 2015 by Rossen Stoyanchev) added runtime validation that checks file extensions in request URLs and adds a Content-Disposition header to force safe handling of responses with dangerous extensions. This protection is active in the target version at AbstractMessageConverterMethodProcessor.java:295 where addContentDispositionHeader() is called before all response writes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download vulnerability) is NOT present in Spring Framework 6.1.18. The fix was already included in the upstream Spring Framework release before TuxCare onboarded it. The vulnerability allowed attackers to craft URLs with malicious file extensions (e.g., .bat, .cmd) causing browsers to download and potentially execute response content as scripts. The upstream fix (commit 2bd1daa75e from October 2015 by Rossen Stoyanchev) added runtime validation that checks file extensions in request URLs and adds a Content-Disposition header to force safe handling of responses with dangerous extensions. This protection is active in the target version at AbstractMessageConverterMethodProcessor.java:295 where addContentDispositionHeader() is called before all response writes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:19:28.539186+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 6.1.18. The vulnerability concerned URL pattern matching inconsistencies between Spring Security and Spring MVC that could lead to authorization bypass. The upstream fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 from April 2016) introduced the HandlerMappingIntrospector API to ensure both frameworks use identical pattern matching logic. This fix was already included in the upstream Spring Framework 6.1.18 release before TuxCare onboarding (September 2026), making the target version not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 6.1.18. The vulnerability concerned URL pattern matching inconsistencies between Spring Security and Spring MVC that could lead to authorization bypass. The upstream fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 from April 2016) introduced the HandlerMappingIntrospector API to ensure both frameworks use identical pattern matching logic. This fix was already included in the upstream Spring Framework 6.1.18 release before TuxCare onboarding (September 2026), making the target version not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:43.517878+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.1.18 is not affected by CVE-2018-11040. The vulnerable JSONP (JSON with Padding) support code that allowed automatic cross-domain requests via \"jsonp\" and \"callback\" query parameters has been completely removed from this version. The JSONP functionality was deprecated in Spring Framework 4.3.18 and 5.0.7 (the CVE fix versions) and was later entirely removed by upstream in commit ac37b678a3. This removal was already present in the upstream 6.1.18 release that TuxCare onboarded, making the vulnerability pattern absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.1.18 is not affected by CVE-2018-11040. The vulnerable JSONP (JSON with Padding) support code that allowed automatic cross-domain requests via \"jsonp\" and \"callback\" query parameters has been completely removed from this version. The JSONP functionality was deprecated in Spring Framework 4.3.18 and 5.0.7 (the CVE fix versions) and was later entirely removed by upstream in commit ac37b678a3. This removal was already present in the upstream 6.1.18 release that TuxCare onboarded, making the vulnerability pattern absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:14:00.204394+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3, where URL path parameters with special encodings could bypass security constraints. The target is Spring Framework 6.1.18-tuxcare.2, which is based on upstream version 6.1.18 released in 2024. The vulnerability fix (SPR-16616) was introduced by upstream Spring developers in March 2018 through commit 0e28...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3, where URL path parameters with special encodings could bypass security constraints. The target is Spring Framework 6.1.18-tuxcare.2, which is based on upstream version 6.1.18 released in 2024. The vulnerability fix (SPR-16616) was introduced by upstream Spring developers in March 2018 through commit 0e28..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target version 6.1.18 is NOT AFFECTED by CVE-2018-1257. The vulnerable pattern (automatic parsing of attacker-controlled selector expressions leading to ReDoS) is not present because Spring Framework 6.1 disabled SpEL selector support by default. The selector feature defaults to null in DefaultSubscriptionRegistry and SimpleBrokerMessageHandler, preventing any expression parsing unless explicit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Target version 6.1.18 is NOT AFFECTED by CVE-2018-1257. The vulnerable pattern (automatic parsing of attacker-controlled selector expressions leading to ReDoS) is not present because Spring Framework 6.1 disabled SpEL selector support by default. The selector feature defaults to null in DefaultSubscriptionRegistry and SimpleBrokerMessageHandler, preventing any expression parsing unless explicit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 is NOT present in target version 6.1.18. The vulnerability was fixed in upstream Spring Framework commit aa11721ff0 (April 27, 2018) by removing a proxy-class check in AopUtils.getMostSpecificMethod() that prevented proper method resolution for security annotations. This fix was included in Spring Framework 5.1.0 and all subsequent versions, including 6.1.0. The target version 6.1.18 inherited this fix from the upstream release when TuxCare onboarded it. The vulnerable pattern (!Proxy.isProxyClass check blocking method resolution) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is NOT present in target version 6.1.18. The vulnerability was fixed in upstream Spring Framework commit aa11721ff0 (April 27, 2018) by removing a proxy-class check in AopUtils.getMostSpecificMethod() that prevented proper method resolution for security annotations. This fix was included in Spring Framework 5.1.0 and all subsequent versions, including 6.1.0. The target version 6.1.18 inherited this fix from the upstream release when TuxCare onboarded it. The vulnerable pattern (!Proxy.isProxyClass check blocking method resolution) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:11:00.161932+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 (directory traversal via URL-encoded path sequences on Windows) is NOT present in Spring Framework 6.1.18-tuxcare.2. The vulnerability was fixed by upstream Spring Framework in March 2018 (commits 0e28bee0, 91b803a2, f59ea610, 13356a7e) and the fixes were already included in the upstream 6.1.18 release that TuxCare onboarded. The target contains complete defense code: PathResource...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 (directory traversal via URL-encoded path sequences on Windows) is NOT present in Spring Framework 6.1.18-tuxcare.2. The vulnerability was fixed by upstream Spring Framework in March 2018 (commits 0e28bee0, 91b803a2, f59ea610, 13356a7e) and the fixes were already included in the upstream 6.1.18 release that TuxCare onboarded. The target contains complete defense code: PathResource..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:35:45.229167+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 is not present in Spring Framework 6.1.18. The vulnerability involved using predictable java.util.Random for generating multipart boundaries, allowing attackers to predict boundary values and inject malicious multipart sections to manipulate server-parsed values (e.g., usernames, roles). The upstream fix (commit ab2410c754, March 2018) replaced Random with SecureRandom, generating cryptographically unpredictable boundaries. This fix was already included in the upstream release when TuxCare onboarded version 6.1.18, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is not present in Spring Framework 6.1.18. The vulnerability involved using predictable java.util.Random for generating multipart boundaries, allowing attackers to predict boundary values and inject malicious multipart sections to manipulate server-parsed values (e.g., usernames, roles). The upstream fix (commit ab2410c754, March 2018) replaced Random with SecureRandom, generating cryptographically unpredictable boundaries. This fix was already included in the upstream release when TuxCare onboarded version 6.1.18, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:46:05.554172+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.1.18 is NOT affected by CVE-2018-15756. The vulnerability (DoS via malicious Range headers with excessive ranges or overlapping ranges) was fixed in upstream Spring Framework commit 423aa28ed5 on 2018-10-03, which shipped in Spring Framework 5.1.1.RELEASE and all subsequent versions including 6.x. The target version 6.1.18-tuxcare.2 contains both required defenses: (1) MAX_RANGES=100 limit in parseRanges() at HttpRange.java:137-139, and (2) sum-of-ranges validation in toResourceRegions() at HttpRange.java:186-196. All Range request handling code paths (ResourceHttpRequestHandler, AbstractMessageConverterMethodProcessor, ResourceHttpMessageWriter, DefaultEntityResponseBuilder) invoke these protected methods. The fix was authored by upstream developer rstoyanchev@pivotal.io and came before TuxCare's onboarding commit c94ba2581f, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.1.18 is NOT affected by CVE-2018-15756. The vulnerability (DoS via malicious Range headers with excessive ranges or overlapping ranges) was fixed in upstream Spring Framework commit 423aa28ed5 on 2018-10-03, which shipped in Spring Framework 5.1.1.RELEASE and all subsequent versions including 6.x. The target version 6.1.18-tuxcare.2 contains both required defenses: (1) MAX_RANGES=100 limit in parseRanges() at HttpRange.java:137-139, and (2) sum-of-ranges validation in toResourceRegions() at HttpRange.java:186-196. All Range request handling code paths (ResourceHttpRequestHandler, AbstractMessageConverterMethodProcessor, ResourceHttpMessageWriter, DefaultEntityResponseBuilder) invoke these protected methods. The fix was authored by upstream developer rstoyanchev@pivotal.io and came before TuxCare's onboarding commit c94ba2581f, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:02:42.476232+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 is a log injection vulnerability where attackers can insert forged log entries by embedding newline and control characters in user input. The target Spring Framework 6.1.18 is NOT affected because upstream Spring Framework already fixed this vulnerability before version 6.1.18 was released. The fix (commit 99c7608f by rstoyanchev@vmware.com) introduced LogFormatUtils sanitization...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 is a log injection vulnerability where attackers can insert forged log entries by embedding newline and control characters in user input. The target Spring Framework 6.1.18 is NOT affected because upstream Spring Framework already fixed this vulnerability before version 6.1.18 was released. The fix (commit 99c7608f by rstoyanchev@vmware.com) introduced LogFormatUtils sanitization..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:41:14.432287+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection vulnerability) is NOT present in Spring Framework 6.1.18. The fix was already included in the upstream 6.1.18 release. The vulnerability allowed attackers to inject fake log entries by including newlines and control characters in user-controlled input that gets logged. The fix (commit 99c7608ffe7 by upstream author rstoyanchev@vmware.com from December 2021) sanitiz...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection vulnerability) is NOT present in Spring Framework 6.1.18. The fix was already included in the upstream 6.1.18 release. The vulnerability allowed attackers to inject fake log entries by including newlines and control characters in user-controlled input that gets logged. The fix (commit 99c7608ffe7 by upstream author rstoyanchev@vmware.com from December 2021) sanitiz..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-core. CVE-2024-22233 describes two DoS vulnerabilities in Spring Framework: (1) malformed forwarded headers causing uncaught exceptions, and (2) URIs with regex metacharacters causing PatternSyntaxException. Both fixes are present in the target Spring Framework 6.1.18-tuxcare.2. The ForwardedHeaderFilter wraps header parsing in try-catch and returns HTTP 400 on errors (commit 4afac17e58, Dec 2023). The HandlerMappingIntrospector uses String.equals() instead of String.matches() for URI comparison (commit 7c9307e970, Jan 2024). Both fixes were authored by upstream developer brian.clozel@broadcom.com and were already included in the upstream Spring Framework 6.1.18 release that TuxCare onboarded (first TuxCare commit c94ba2581f). The vulnerable patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 describes two DoS vulnerabilities in Spring Framework: (1) malformed forwarded headers causing uncaught exceptions, and (2) URIs with regex metacharacters causing PatternSyntaxException. Both fixes are present in the target Spring Framework 6.1.18-tuxcare.2. The ForwardedHeaderFilter wraps header parsing in try-catch and returns HTTP 400 on errors (commit 4afac17e58, Dec 2023). The HandlerMappingIntrospector uses String.equals() instead of String.matches() for URI comparison (commit 7c9307e970, Jan 2024). Both fixes were authored by upstream developer brian.clozel@broadcom.com and were already included in the upstream Spring Framework 6.1.18 release that TuxCare onboarded (first TuxCare commit c94ba2581f). The vulnerable patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:16:11.208290+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.1.18-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:16:11.208290+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.1.18-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}