{
  "@id": "urn:uuid:1e6a5fda-3743-46ab-9546-c3b774e41d3f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:41:12.900770+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T13:09:28.641700+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is a JDK vulnerability affecting \"java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6\" causing CPU exhaustion via catastrophic backtracking with regex patterns containing multiple optional groups. Spring Framework 6.2.12 requires Java 17 (confirmed by .sdkmanrc and JavaConventions.java), which is 11 major versions beyond the vulnerable JDK range. Wh...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is a JDK vulnerability affecting \"java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6\" causing CPU exhaustion via catastrophic backtracking with regex patterns containing multiple optional groups. Spring Framework 6.2.12 requires Java 17 (confirmed by .sdkmanrc and JavaConventions.java), which is 11 major versions beyond the vulnerable JDK range. Wh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:41:12.900770+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 6.2.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 6.2.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:56:00.171848+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.12 is NOT affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes) was fixed in the upstream Spring Framework codebase in July 2011 by commit 7d8aa05c40 (author: jhoeller@vmware.com). The fix adds an `acceptProxyClasses` flag to ConfigurableObjectInputStream that, when disabled, blocks deserialization of proxy classes by throwing NotSerializabl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.12 is NOT affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes) was fixed in the upstream Spring Framework codebase in July 2011 by commit 7d8aa05c40 (author: jhoeller@vmware.com). The fix adds an `acceptProxyClasses` flag to ConfigurableObjectInputStream that, when disabled, blocks deserialization of proxy classes by throwing NotSerializabl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 6.2.12 is NOT affected by CVE-2014-3578. The vulnerability (directory traversal via crafted URLs with embedded colons) was fixed in the upstream Spring Framework release and shipped with version 6.2.12. The fix commit (8ee465103850a3dca018273fe5952e40d5c45a66) by upstream author rstoyanchev@gopivotal.com is present in HEAD and predates all TuxCare commits, confirming...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.2.12 is NOT affected by CVE-2014-3578. The vulnerability (directory traversal via crafted URLs with embedded colons) was fixed in the upstream Spring Framework release and shipped with version 6.2.12. The fix commit (8ee465103850a3dca018273fe5952e40d5c45a66) by upstream author rstoyanchev@gopivotal.com is present in HEAD and predates all TuxCare commits, confirming..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:21:08.318837+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then non-secure Random). The fix in 4.1.5 replaced it with JdkIdGenerator that calls UUID.randomUUID() for cryptographically secure session IDs. The target version 6.2.12-tuxcare.2 already contai...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then non-secure Random). The fix in 4.1.5 replaced it with JdkIdGenerator that calls UUID.randomUUID() for cryptographically secure session IDs. The target version 6.2.12-tuxcare.2 already contai..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:11.896857+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.12 is not affected by CVE-2015-5211 (Reflected File Download attack). The vulnerability was fixed in the upstream Spring Framework 4.2.2 release (October 2015) via commit 2bd1daa75e by Rossen Stoyanchev. The fix adds a Content-Disposition header with a safe filename when responses have non-whitelisted file extensions, preventing browsers from downloading malicious content with dangerous extensions like .bat or .cmd. This upstream fix was included in Spring 6.2.12 when TuxCare onboarded the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.2.12 is not affected by CVE-2015-5211 (Reflected File Download attack). The vulnerability was fixed in the upstream Spring Framework 4.2.2 release (October 2015) via commit 2bd1daa75e by Rossen Stoyanchev. The fix adds a Content-Disposition header with a safe filename when responses have non-whitelisted file extensions, preventing browsers from downloading malicious content with dangerous extensions like .bat or .cmd. This upstream fix was included in Spring 6.2.12 when TuxCare onboarded the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:20:11.775734+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 addresses authorization bypass due to inconsistent URL pattern matching between Spring Security and Spring MVC. The upstream vendor fix (commit a30ab30e4e by Rossen Stoyanchev, April 2016) introduced MatchableHandlerMapping interface, HandlerMappingIntrospector, and RequestMatchResult classes to provide a standardized pattern matching API. This fix was already present in the upstream Spring Framework 6.2.12 release before TuxCare began maintenance. The target contains the complete fix implementation with MatchableHandlerMapping properly implemented by AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The vulnerable pattern (lack of standardized API causing pattern matching inconsistencies) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses authorization bypass due to inconsistent URL pattern matching between Spring Security and Spring MVC. The upstream vendor fix (commit a30ab30e4e by Rossen Stoyanchev, April 2016) introduced MatchableHandlerMapping interface, HandlerMappingIntrospector, and RequestMatchResult classes to provide a standardized pattern matching API. This fix was already present in the upstream Spring Framework 6.2.12 release before TuxCare began maintenance. The target contains the complete fix implementation with MatchableHandlerMapping properly implemented by AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The vulnerable pattern (lack of standardized API causing pattern matching inconsistencies) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:43.517878+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.12 is not affected by CVE-2018-11040. The vulnerability concerns JSONP (JSON with Padding) support that was automatically enabled by default in MappingJackson2JsonView through the \"jsonp\" and \"callback\" query parameters, allowing cross-domain requests. This JSONP functionality was completely removed from Spring Framework in version 5.1 (commit ac37b678a3), long before the 6.2.12 release. The vulnerable code (jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, and all JSONP-related methods) does not exist in the target repository. This removal was an upstream change authored by sdeleuze@pivotal.io and shipped in the upstream Spring Framework 5.1 release, predating all TuxCare maintenance work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.2.12 is not affected by CVE-2018-11040. The vulnerability concerns JSONP (JSON with Padding) support that was automatically enabled by default in MappingJackson2JsonView through the \"jsonp\" and \"callback\" query parameters, allowing cross-domain requests. This JSONP functionality was completely removed from Spring Framework in version 5.1 (commit ac37b678a3), long before the 6.2.12 release. The vulnerable code (jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, and all JSONP-related methods) does not exist in the target repository. This removal was an upstream change authored by sdeleuze@pivotal.io and shipped in the upstream Spring Framework 5.1 release, predating all TuxCare maintenance work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:15:16.880365+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 6.2.12-tuxcare.2 is not affected by CVE-2018-1199. The vulnerability, which allowed bypassing security constraints via specially encoded URL path parameters (e.g., %2E%2E%2F for path traversal), was fixed in the upstream Spring Framework release through commit 0e28bee0f1 on 2018-03-19. This fix predates all TuxCare maintenance of this version (16,090 commits before t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.2.12-tuxcare.2 is not affected by CVE-2018-1199. The vulnerability, which allowed bypassing security constraints via specially encoded URL path parameters (e.g., %2E%2E%2F for path traversal), was fixed in the upstream Spring Framework release through commit 0e28bee0f1 on 2018-03-19. This fix predates all TuxCare maintenance of this version (16,090 commits before t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions prior to 4.3.17 and 5.0.6, where attacker-controlled selector header values in STOMP subscription messages are unconditionally parsed as Spring EL expressions, enabling ReDoS attacks. The target version 6.2.12 is NOT affected - the vulnerable code pattern is not present. The upstream fix (commit 5bc80fc094 by Sam Brannen, June 2023) disables the S...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions prior to 4.3.17 and 5.0.6, where attacker-controlled selector header values in STOMP subscription messages are unconditionally parsed as Spring EL expressions, enabling ReDoS attacks. The target version 6.2.12 is NOT affected - the vulnerable code pattern is not present. The upstream fix (commit 5bc80fc094 by Sam Brannen, June 2023) disables the S..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 is NOT present in Spring Framework 6.2.12. The vulnerability affected Spring Framework 5.0.5 and was fixed upstream by Juergen Hoeller on 2018-04-27 (commit aa11721ff0f). The fix ensures correct method resolution when checking for security annotations on JDK dynamic proxies, preventing authorization bypass. This fix was already included in the upstream Spring Framework 6.2.12 release that TuxCare onboarded on 2026-09-14, making the target inherently safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is NOT present in Spring Framework 6.2.12. The vulnerability affected Spring Framework 5.0.5 and was fixed upstream by Juergen Hoeller on 2018-04-27 (commit aa11721ff0f). The fix ensures correct method resolution when checking for security annotations on JDK dynamic proxies, preventing authorization bypass. This fix was already included in the upstream Spring Framework 6.2.12 release that TuxCare onboarded on 2026-09-14, making the target inherently safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:17:00.109182+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 (Windows directory traversal via backslash path sequences) is NOT present in Spring Framework 6.2.12. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The required fix (backslash normalization and Windows path traversal check) was already present in the upstream Spring Framework 6.2.12 release that TuxCare onboarded. The fix commit (c6fa180602) by up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 (Windows directory traversal via backslash path sequences) is NOT present in Spring Framework 6.2.12. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The required fix (backslash normalization and Windows path traversal check) was already present in the upstream Spring Framework 6.2.12 release that TuxCare onboarded. The fix commit (c6fa180602) by up..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:39:18.885622+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272: Spring Framework multipart boundary prediction vulnerability. The target Spring Framework 6.2.12 is NOT AFFECTED. The vulnerable pattern (using predictable java.util.Random for boundary generation) is absent. The upstream fix (commit ab2410c754 from March 2018) replaced Random with SecureRandom, making multipart boundaries cryptographically unpredictable and preventing attackers from injecting additional multipart sections. This fix shipped in the upstream Spring Framework 6.2.12 release that TuxCare onboarded, prior to any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272: Spring Framework multipart boundary prediction vulnerability. The target Spring Framework 6.2.12 is NOT AFFECTED. The vulnerable pattern (using predictable java.util.Random for boundary generation) is absent. The upstream fix (commit ab2410c754 from March 2018) replaced Random with SecureRandom, making multipart boundaries cryptographically unpredictable and preventing attackers from injecting additional multipart sections. This fix shipped in the upstream Spring Framework 6.2.12 release that TuxCare onboarded, prior to any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:46:35.987953+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.12 is not affected by CVE-2018-15756. The vulnerability concerns HTTP Range header DoS attacks via excessive ranges or overlapping/wide ranges. The upstream fix (commits 423aa28ed58 and da557e74151 from October 2018 and April 2019) shipped in the Spring Framework release before TuxCare onboarded version 6.2.12. Both defense mechanisms are present: (1) MAX_RANGES=100 limit in parseRanges() at lines 137-139, and (2) sum-of-ranges validation in toResourceRegions() at lines 186-196. The defenses are properly integrated into ResourceHttpRequestHandler (line 631) with appropriate 416 error handling (lines 633-637).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.2.12 is not affected by CVE-2018-15756. The vulnerability concerns HTTP Range header DoS attacks via excessive ranges or overlapping/wide ranges. The upstream fix (commits 423aa28ed58 and da557e74151 from October 2018 and April 2019) shipped in the Spring Framework release before TuxCare onboarded version 6.2.12. Both defense mechanisms are present: (1) MAX_RANGES=100 limit in parseRanges() at lines 137-139, and (2) sum-of-ranges validation in toResourceRegions() at lines 186-196. The defenses are properly integrated into ResourceHttpRequestHandler (line 631) with appropriate 416 error handling (lines 633-637).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:09:00.170791+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.12 is NOT affected by CVE-2021-22060. The vulnerability fix (log injection protection via LogFormatUtils sanitization of newlines and control characters) was shipped in the upstream 6.2.12 release before TuxCare began maintaining this version. The fix is present in LogFormatUtils.java and is applied in all critical locations where user-controlled data (paths, URLs, URIs) is...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.12 is NOT affected by CVE-2021-22060. The vulnerability fix (log injection protection via LogFormatUtils sanitization of newlines and control characters) was shipped in the upstream 6.2.12 release before TuxCare began maintaining this version. The fix is present in LogFormatUtils.java and is applied in all critical locations where user-controlled data (paths, URLs, URIs) is..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:44:00.067656+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via unsanitized newlines/control characters) is NOT present in Spring Framework 6.2.12-tuxcare.2. The upstream vendor (Spring/VMware) fixed this vulnerability before the 6.2.12 release via commit 99c7608ffe by Rossen Stoyanchev. The fix enhances LogFormatUtils.formatValue() to replace newlines with <EOL> and control characters with ?, preventing log injection. This...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via unsanitized newlines/control characters) is NOT present in Spring Framework 6.2.12-tuxcare.2. The upstream vendor (Spring/VMware) fixed this vulnerability before the 6.2.12 release via commit 99c7608ffe by Rossen Stoyanchev. The fix enhances LogFormatUtils.formatValue() to replace newlines with <EOL> and control characters with ?, preventing log injection. This..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.12 is NOT AFFECTED by CVE-2024-22233. Both required fixes (ForwardedHeaderFilter exception handling and HandlerMappingIntrospector URI matching) were already present in the upstream Spring Framework 6.2.12 release. The CVE specifically mentions versions 6.0.15 and 6.1.2 as affected; version 6.2.12 is a later release that shipped with the fixes already applied by upstream Spring maintainers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Spring Framework 6.2.12 is NOT AFFECTED by CVE-2024-22233. Both required fixes (ForwardedHeaderFilter exception handling and HandlerMappingIntrospector URI matching) were already present in the upstream Spring Framework 6.2.12 release. The CVE specifically mentions versions 6.0.15 and 6.1.2 as affected; version 6.2.12 is a later release that shipped with the fixes already applied by upstream Spring maintainers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:17.696488+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-core. The target repository (Spring Framework 6.2.12-tuxcare.2) is NOT AFFECTED by CVE-2025-41249. The vulnerability (annotations not detected on methods in type hierarchies with unresolved generics) has already been fixed by the upstream vendor. The fix was shipped in the upstream Spring Framework 6.2.12 release, which TuxCare onboarded on 2a6ad5ff82d2fbcf7e76d0f0bf1303ca0b0cfdda. Both required patches (6d710d482a6785b069e35022e81758953afc21ff and 0e3e34bee0c5b452b51c6ff6184e071a73ee2d40) by Sam Brannen are present in the target's ancestry before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "impact_statement": "The target repository (Spring Framework 6.2.12-tuxcare.2) is NOT AFFECTED by CVE-2025-41249. The vulnerability (annotations not detected on methods in type hierarchies with unresolved generics) has already been fixed by the upstream vendor. The fix was shipped in the upstream Spring Framework 6.2.12 release, which TuxCare onboarded on 2a6ad5ff82d2fbcf7e76d0f0bf1303ca0b0cfdda. Both required patches (6d710d482a6785b069e35022e81758953afc21ff and 0e3e34bee0c5b452b51c6ff6184e071a73ee2d40) by Sam Brannen are present in the target's ancestry before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:13:00.193957+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}