{
  "@id": "urn:uuid:766b5cf5-fadf-4206-ae42-773007154942",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:38:00.045928+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:43:00.299427+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6 that causes CPU exhaustion via regex patterns with multiple optional groups. Spring Framework 6.1.7 requires Java 17 (confirmed in JavaConventions.java:74), which is approximately 15 years newer than the affected JDK versions an...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6 that causes CPU exhaustion via regex patterns with multiple optional groups. Spring Framework 6.1.7 requires Java 17 (confirmed in JavaConventions.java:74), which is approximately 15 years newer than the affected JDK versions an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:38:00.045928+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:50:00.107701+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affected Spring Framework 3.0.0-3.0.5 via deserialization of malicious proxy classes in the RMI remoting module. Spring Framework 6.1.7 is not affected because: (1) The vulnerable RemoteInvocationSerializingExporter class and entire RMI remoting module were removed by upstream in 2021 (commit 5822f1bf85); (2) ConfigurableObjectInputStream includes the acceptProxyClasses protection...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affected Spring Framework 3.0.0-3.0.5 via deserialization of malicious proxy classes in the RMI remoting module. Spring Framework 6.1.7 is not affected because: (1) The vulnerable RemoteInvocationSerializingExporter class and entire RMI remoting module were removed by upstream in 2021 (commit 5822f1bf85); (2) ConfigurableObjectInputStream includes the acceptProxyClasses protection..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 6.1.7. The vulnerability was a directory traversal flaw in StringUtils.cleanPath() that allowed attackers to bypass path normalization using crafted URLs with colons in path segments (e.g., /a/:b/../../file). The fix was introduced by upstream commit 8ee465103 (May 15, 2014) by Rossen Stoyanchev, which added a check to discard prefixes containing...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 6.1.7. The vulnerability was a directory traversal flaw in StringUtils.cleanPath() that allowed attackers to bypass path normalization using crafted URLs with colons in path segments (e.g., /a/:b/../../file). The fix was introduced by upstream commit 8ee465103 (May 15, 2014) by Rossen Stoyanchev, which added a check to discard prefixes containing..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:15:37.688994+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in upstream Spring Framework 4.1.5 (January 2015) by switching from AlternativeJdkIdGenerator (which used predictable java.util.Random after initial seed) to JdkIdGenerator (which uses cryptographically secure UUID.randomUUID()). The target v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in upstream Spring Framework 4.1.5 (January 2015) by switching from AlternativeJdkIdGenerator (which used predictable java.util.Random after initial seed) to JdkIdGenerator (which uses cryptographically secure UUID.randomUUID()). The target v..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:05:07.573388+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download / RFD attack) is not present in Spring Framework 6.1.7. The upstream vendor fix (commit 2bd1daa75e by Rossen Stoyanchev) was already included in the upstream release when TuxCare onboarded version 6.1.7. The fix adds Content-Disposition headers with safe filenames for responses with unsafe file extensions, preventing browsers from downloading/executing responses as batch scripts. The defense code is present in AbstractMessageConverterMethodProcessor with an expanded SAFE_EXTENSIONS whitelist. Additionally, JSONP support (another RFD vector) has been completely removed in Spring Framework 6.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download / RFD attack) is not present in Spring Framework 6.1.7. The upstream vendor fix (commit 2bd1daa75e by Rossen Stoyanchev) was already included in the upstream release when TuxCare onboarded version 6.1.7. The fix adds Content-Disposition headers with safe filenames for responses with unsafe file extensions, preventing browsers from downloading/executing responses as batch scripts. The defense code is present in AbstractMessageConverterMethodProcessor with an expanded SAFE_EXTENSIONS whitelist. Additionally, JSONP support (another RFD vector) has been completely removed in Spring Framework 6.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:16:19.686333+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.7 is not affected by CVE-2016-5007. The vulnerability involved inconsistent URL pattern matching between Spring Security and Spring MVC, allowing authorization bypasses. The upstream fix (commit a30ab30e4e, April 2016) introduced a HandlerMappingIntrospector API and MatchableHandlerMapping interface to expose Spring MVC's internal pattern matching logic, enabling Spring Security to use identical matching rules. This fix was already present in upstream Spring Framework 6.1.7 when TuxCare onboarded it (first TuxCare commit: 951dff3c13 \"Onboard version 6.1.7\"). All defense components are verified present in the target: MatchableHandlerMapping interface, HandlerMappingIntrospector class, RequestMatchResult class, and match() method implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The HandlerMappingIntrospector Javadoc explicitly states its security purpose: \"to allow Spring Security to align its pattern matching with the same pattern matching that would be used in Spring MVC for a given request, in order to avoid security issues.\"\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 6.1.7 is not affected by CVE-2016-5007. The vulnerability involved inconsistent URL pattern matching between Spring Security and Spring MVC, allowing authorization bypasses. The upstream fix (commit a30ab30e4e, April 2016) introduced a HandlerMappingIntrospector API and MatchableHandlerMapping interface to expose Spring MVC's internal pattern matching logic, enabling Spring Security to use identical matching rules. This fix was already present in upstream Spring Framework 6.1.7 when TuxCare onboarded it (first TuxCare commit: 951dff3c13 \"Onboard version 6.1.7\"). All defense components are verified present in the target: MatchableHandlerMapping interface, HandlerMappingIntrospector class, RequestMatchResult class, and match() method implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The HandlerMappingIntrospector Javadoc explicitly states its security purpose: \"to allow Spring Security to align its pattern matching with the same pattern matching that would be used in Spring MVC for a given request, in order to avoid security issues.\"\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:31.761827+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. Target Spring Framework 6.1.7 is not affected by CVE-2018-11040. JSONP functionality (automatic cross-domain requests via \"jsonp\"/\"callback\" query parameters) was completely removed by upstream in Spring Framework 5.1.0 (commit ac37b678a3, Sept 2018, author sdeleuze@pivotal.io). The removal was already present in the upstream release when TuxCare onboarded version 6.1.7. No JSONP code exists in target: MappingJackson2JsonView lacks jsonpParameterNames field and callback wrapping logic, MappingJacksonValue lacks setJsonpFunction/getJsonpFunction methods, AbstractJsonpResponseBodyAdvice class doesn't exist. Codebase-wide search confirms zero JSONP-related methods. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Target Spring Framework 6.1.7 is not affected by CVE-2018-11040. JSONP functionality (automatic cross-domain requests via \"jsonp\"/\"callback\" query parameters) was completely removed by upstream in Spring Framework 5.1.0 (commit ac37b678a3, Sept 2018, author sdeleuze@pivotal.io). The removal was already present in the upstream release when TuxCare onboarded version 6.1.7. No JSONP code exists in target: MappingJackson2JsonView lacks jsonpParameterNames field and callback wrapping logic, MappingJacksonValue lacks setJsonpFunction/getJsonpFunction methods, AbstractJsonpResponseBodyAdvice class doesn't exist. Codebase-wide search confirms zero JSONP-related methods. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:07:26.495159+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 (SPR-16616) was fixed by the upstream Spring Framework project in March 2018 and released in version 5.0.5. The target repository (Spring Framework 6.1.7) contains the complete upstream fix, which was already present when TuxCare onboarded this version in July 2026. The fix includes: (1) processPath() method that normalizes path separators (backslash to slash) and removes duplicat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 (SPR-16616) was fixed by the upstream Spring Framework project in March 2018 and released in version 5.0.5. The target repository (Spring Framework 6.1.7) contains the complete upstream fix, which was already present when TuxCare onboarded this version in July 2026. The fix includes: (1) processPath() method that normalizes path separators (backslash to slash) and removes duplicat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2018-1257. The vulnerability involves a regex DoS attack via malicious Spring EL expressions in STOMP subscription selector headers. In Spring Framework 6.1+, the SpEL selector feature is disabled by default (selectorHeaderName defaults to null), preventing the vulnerable expression parsing code from being reached. This fix was shipped in the upstre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2018-1257. The vulnerability involves a regex DoS attack via malicious Spring EL expressions in STOMP subscription selector headers. In Spring Framework 6.1+, the SpEL selector feature is disabled by default (selectorHeaderName defaults to null), preventing the vulnerable expression parsing code from being reached. This fix was shipped in the upstre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. CVE-2018-1258 is NOT present in Spring Framework 6.1.7-tuxcare.9. The vulnerability was an authorization bypass in Spring Framework 5.0.5 when using method security with JDK dynamic proxies. The issue was caused by incorrect method resolution that prevented security annotations from being discovered on proxy-wrapped beans. The upstream fix (commit aa11721ff0 by jhoeller@pivotal.io, April 2018) removed the problematic `!Proxy.isProxyClass(targetClass)` check from AopUtils.getMostSpecificMethod and added proper proxy handling in AnnotationMethodMatcher. This fix was already present in the upstream Spring Framework 6.1.7 release that TuxCare onboarded (commit 951dff3c13 by evasilev@cloudlinux.com), making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is NOT present in Spring Framework 6.1.7-tuxcare.9. The vulnerability was an authorization bypass in Spring Framework 5.0.5 when using method security with JDK dynamic proxies. The issue was caused by incorrect method resolution that prevented security annotations from being discovered on proxy-wrapped beans. The upstream fix (commit aa11721ff0 by jhoeller@pivotal.io, April 2018) removed the problematic `!Proxy.isProxyClass(targetClass)` check from AopUtils.getMostSpecificMethod and added proper proxy handling in AnnotationMethodMatcher. This fix was already present in the upstream Spring Framework 6.1.7 release that TuxCare onboarded (commit 951dff3c13 by evasilev@cloudlinux.com), making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:57:19.396013+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.7 is NOT affected by CVE-2018-1271 (Windows directory traversal). The vulnerability pattern has been removed by upstream fix commit 91b803a231 authored by jhoeller@pivotal.io (Spring Framework maintainer). This fix was already present in the upstream 6.1.7 release before TuxCare onboarding (first TuxCare commit: 951dff3c13). The fix includes: (1) isInvalidEncodedPath() meth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.7 is NOT affected by CVE-2018-1271 (Windows directory traversal). The vulnerability pattern has been removed by upstream fix commit 91b803a231 authored by jhoeller@pivotal.io (Spring Framework maintainer). This fix was already present in the upstream 6.1.7 release before TuxCare onboarding (first TuxCare commit: 951dff3c13). The fix includes: (1) isInvalidEncodedPath() meth..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.7 is NOT affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using java.util.Random, which could allow attackers to inject additional multipart parts in proxied requests. The target repository contains the upstream fix (using SecureRandom with lazy initialization) that was shipped in the original Spring Framework release, authored by upstream developers Rossen Stoyanchev and Juergen Hoeller in 2018. The vulnerable pattern (new Random()) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.1.7 is NOT affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using java.util.Random, which could allow attackers to inject additional multipart parts in proxied requests. The target repository contains the upstream fix (using SecureRandom with lazy initialization) that was shipped in the original Spring Framework release, authored by upstream developers Rossen Stoyanchev and Juergen Hoeller in 2018. The vulnerable pattern (new Random()) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:43.996674+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.7 is not affected by CVE-2018-15756. The vulnerability (DoS via malicious HTTP Range headers with excessive ranges or overlapping ranges) was fixed in upstream Spring Framework commit 423aa28ed5 by Rossen Stoyanchev, which shipped in the upstream release before TuxCare onboarded version 6.1.7. Both required defenses are present: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges, and (2) sum validation rejecting overlapping ranges where total >= resource length. All entry points (HttpHeaders.getRange, ResourceHttpRequestHandler, ResourceHttpMessageWriter) route through the validated HttpRange.parseRanges() and HttpRange.toResourceRegions() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.1.7 is not affected by CVE-2018-15756. The vulnerability (DoS via malicious HTTP Range headers with excessive ranges or overlapping ranges) was fixed in upstream Spring Framework commit 423aa28ed5 by Rossen Stoyanchev, which shipped in the upstream release before TuxCare onboarded version 6.1.7. Both required defenses are present: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges, and (2) sum validation rejecting overlapping ranges where total >= resource length. All entry points (HttpHeaders.getRange, ResourceHttpRequestHandler, ResourceHttpMessageWriter) route through the validated HttpRange.parseRanges() and HttpRange.toResourceRegions() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:15.621975+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection vulnerability) is not present in Spring Framework 6.1.7. The upstream fix was already included in the Spring Framework 6.1.7 release before TuxCare onboarded it. The fix consists of LogFormatUtils.formatValue() with NEWLINE_PATTERN and CONTROL_CHARACTER_PATTERN sanitization, applied across multiple logging locations including PathResourceResolver, ResourceWebHandle...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection vulnerability) is not present in Spring Framework 6.1.7. The upstream fix was already included in the Spring Framework 6.1.7 release before TuxCare onboarded it. The fix consists of LogFormatUtils.formatValue() with NEWLINE_PATTERN and CONTROL_CHARACTER_PATTERN sanitization, applied across multiple logging locations including PathResourceResolver, ResourceWebHandle..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T21:34:49.807301+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2021-22096 (log injection vulnerability). The fix for this vulnerability was already present in the upstream Spring Framework 6.1.7 release that TuxCare onboarded. The vulnerable pattern (lack of input sanitization before logging) does not exist in the target because upstream commit 99c7608ffe by Rossen Stoyanchev introduced LogFormatUtils sanitizat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2021-22096 (log injection vulnerability). The fix for this vulnerability was already present in the upstream Spring Framework 6.1.7 release that TuxCare onboarded. The vulnerable pattern (lack of input sanitization before logging) does not exist in the target because upstream commit 99c7608ffe by Rossen Stoyanchev introduced LogFormatUtils sanitizat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.1.7-tuxcare.1 of org.springframework:spring-core. Target Spring Framework 6.1.7 is not affected by CVE-2024-22233. Both vulnerability fixes (ForwardedHeaderFilter exception handling and HandlerMappingIntrospector URI matching) were included in the upstream Spring Framework 6.1.7 release (May 16, 2024) before TuxCare onboarded the version (July 26, 2026). The vulnerable code patterns are not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Target Spring Framework 6.1.7 is not affected by CVE-2024-22233. Both vulnerability fixes (ForwardedHeaderFilter exception handling and HandlerMappingIntrospector URI matching) were included in the upstream Spring Framework 6.1.7 release (May 16, 2024) before TuxCare onboarded the version (July 26, 2026). The vulnerable code patterns are not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 6.1.7-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 6.1.7-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T16:47:13.430436+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.1.7-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.7-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.1.7-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.7-tuxcare.8."
    }
  ]
}