{
  "@id": "urn:uuid:a2ecc690-8f55-44b7-bc75-a59ac99dc671",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:38:00.045928+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:44:20.901878+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before version 1.6. Spring Framework 6.2.13 requires JDK 17+ (confirmed in gradle.properties), where this specific algorithmic complexity vulnerability has been fixed at the JDK level. While Spring still compiles regex patterns from s...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before version 1.6. Spring Framework 6.2.13 requires JDK 17+ (confirmed in gradle.properties), where this specific algorithmic complexity vulnerability has been fixed at the JDK level. While Spring still compiles regex patterns from s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:38:00.045928+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:49:00.106689+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 targets Java proxy class deserialization in Spring Framework 3.0.0-3.0.5 RMI remoting. Spring Framework 6.2.13 is not affected because: (1) The vulnerable RMI remoting classes (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) were completely removed in Spring Framework 6.0 (September 2021, commit 5822f1bf85); (2) ConfigurableObjectInputStream contains the accep...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 targets Java proxy class deserialization in Spring Framework 3.0.0-3.0.5 RMI remoting. Spring Framework 6.2.13 is not affected because: (1) The vulnerable RMI remoting classes (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) were completely removed in Spring Framework 6.0 (September 2021, commit 5822f1bf85); (2) ConfigurableObjectInputStream contains the accep..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.2.13. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already included in the upstream release 6.2.13 before TuxCare onboarded it. The vulnerable code pattern has been replaced with defensive logic in StringUtils.cleanPath() that prevents treating pseudo-URI-scheme patterns (paths with \"/...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.2.13. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already included in the upstream release 6.2.13 before TuxCare onboarded it. The vulnerable code pattern has been replaced with defensive logic in StringUtils.cleanPath() that prevents treating pseudo-URI-scheme patterns (paths with \"/..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:14:03.234394+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target version 6.2.13-tuxcare.4 is not vulnerable because it uses JdkIdGenerator (introduced in 4.1.5 as the fix) which generates session IDs via UUID.randomUUID(), a cryptographically secure random number generator. The vulnerable code pattern (predictable session I...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target version 6.2.13-tuxcare.4 is not vulnerable because it uses JdkIdGenerator (introduced in 4.1.5 as the fix) which generates session IDs via UUID.randomUUID(), a cryptographically secure random number generator. The vulnerable code pattern (predictable session I..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:06:00.441936+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.13 is not affected by CVE-2015-5211 (Reflected File Download attack via JSONP). The vulnerable JSONP functionality was completely removed in Spring 5.1.0 (June 2018), well before this version. The upstream vendor fix (commit 2bd1daa75e) was originally applied in v4.2.2 (October 2015) and is present in the target, but the entire attack surface has since been eliminated through architectural changes: JSONP support removal, deprecation of path extension content negotiation, and removal of vulnerable utility methods. The target processes no JSONP requests and cannot be exploited via the RFD attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.2.13 is not affected by CVE-2015-5211 (Reflected File Download attack via JSONP). The vulnerable JSONP functionality was completely removed in Spring 5.1.0 (June 2018), well before this version. The upstream vendor fix (commit 2bd1daa75e) was originally applied in v4.2.2 (October 2015) and is present in the target, but the entire attack surface has since been eliminated through architectural changes: JSONP support removal, deprecation of path extension content negotiation, and removal of vulnerable utility methods. The target processes no JSONP requests and cannot be exploited via the RFD attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:15:34.961054+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. The target repository (Spring Framework 6.2.13-tuxcare.4) is NOT AFFECTED by CVE-2016-5007. The vulnerability concerned pattern-matching divergence between Spring Security and Spring MVC in versions 3.2.x through 4.2.x, allowing authorization bypass. The upstream fix (commit a30ab30e4e \"Introduce HandlerMapping introspection API\" by Rossen Stoyanchev) was shipped in the Spring Framework 6.2.13 release that TuxCare onboarded. All fix components are present and properly integrated: MatchableHandlerMapping interface, HandlerMappingIntrospector helper class, RequestMatchResult container, and match() implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping. These expose Spring MVC's exact pattern matching logic to Spring Security, eliminating the divergence that enabled the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target repository (Spring Framework 6.2.13-tuxcare.4) is NOT AFFECTED by CVE-2016-5007. The vulnerability concerned pattern-matching divergence between Spring Security and Spring MVC in versions 3.2.x through 4.2.x, allowing authorization bypass. The upstream fix (commit a30ab30e4e \"Introduce HandlerMapping introspection API\" by Rossen Stoyanchev) was shipped in the Spring Framework 6.2.13 release that TuxCare onboarded. All fix components are present and properly integrated: MatchableHandlerMapping interface, HandlerMappingIntrospector helper class, RequestMatchResult container, and match() implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping. These expose Spring MVC's exact pattern matching logic to Spring Security, eliminating the divergence that enabled the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:31.761827+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.13 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed from the codebase in upstream commit ac37b678a3 (June 7, 2018) before any Spring 6.x release. The CVE affected versions 5.0.x < 5.0.7 and 4.3.x < 4.3.18, where JSONP was deprecated and disabled by default. In Spring 6.x, JSONP was entirely removed\u2014no MappingJackson2JsonView.jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, no JSONP transport handlers. The removal was authored by upstream Spring developer sdeleuze@pivotal.io and shipped in the upstream 6.2.13 release that TuxCare onboarded (commit 819b4ff3b7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.2.13 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed from the codebase in upstream commit ac37b678a3 (June 7, 2018) before any Spring 6.x release. The CVE affected versions 5.0.x < 5.0.7 and 4.3.x < 4.3.18, where JSONP was deprecated and disabled by default. In Spring 6.x, JSONP was entirely removed\u2014no MappingJackson2JsonView.jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, no JSONP transport handlers. The removal was authored by upstream Spring developer sdeleuze@pivotal.io and shipped in the upstream 6.2.13 release that TuxCare onboarded (commit 819b4ff3b7).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:07:56.973372+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.13 is NOT affected by CVE-2018-1199. The vulnerability involves bypassing security constraints via URL path parameters with special encodings (duplicate slashes, backslashes, encoded path traversal sequences) to access static resources outside allowed locations. The upstream Spring Framework developers fixed this issue in SPR-16616 (commits 0e28bee0f1, 91b803a231, 13356a7ee...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.13 is NOT affected by CVE-2018-1199. The vulnerability involves bypassing security constraints via URL path parameters with special encodings (duplicate slashes, backslashes, encoded path traversal sequences) to access static resources outside allowed locations. The upstream Spring Framework developers fixed this issue in SPR-16616 (commits 0e28bee0f1, 91b803a231, 13356a7ee..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.13 is NOT AFFECTED by CVE-2018-1257. The vulnerability allowed attackers to craft malicious Spring EL expressions in STOMP subscription message selector headers, causing denial of service through excessive CPU consumption. The upstream fix (commit 5bc80fc094 by Sam Brannen, June 2023) disabled the selector header feature by default, preventing expression parsing unless expl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.13 is NOT AFFECTED by CVE-2018-1257. The vulnerability allowed attackers to craft malicious Spring EL expressions in STOMP subscription message selector headers, causing denial of service through excessive CPU consumption. The upstream fix (commit 5bc80fc094 by Sam Brannen, June 2023) disabled the selector header feature by default, preventing expression parsing unless expl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 describes an authorization bypass in Spring Framework 5.0.5 when using method security with JDK dynamic proxies. The vulnerability was fixed in upstream Spring Framework in April 2018. The target (Spring Framework 6.2.13-tuxcare.4) already contains the complete fix, which shipped in the upstream v6.2.13 release. The vulnerable pattern (incorrect method resolution on proxy classes leading to missing security annotation checks) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 describes an authorization bypass in Spring Framework 5.0.5 when using method security with JDK dynamic proxies. The vulnerability was fixed in upstream Spring Framework in April 2018. The target (Spring Framework 6.2.13-tuxcare.4) already contains the complete fix, which shipped in the upstream v6.2.13 release. The vulnerable pattern (incorrect method resolution on proxy classes leading to missing security annotation checks) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:58:51.635307+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2018-1271. The vulnerability affected versions 5.0 < 5.0.5 and 4.3 < 4.3.15. The fix for this Windows directory traversal vulnerability was introduced by upstream Spring Framework in March 2018 (commits 91b803a231 and 0e28bee0f1) and is present in the upstream 6.2.13 release that TuxCare onboarded. The vulnerable code pattern is not present in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2018-1271. The vulnerability affected versions 5.0 < 5.0.5 and 4.3 < 4.3.15. The fix for this Windows directory traversal vulnerability was introduced by upstream Spring Framework in March 2018 (commits 91b803a231 and 0e28bee0f1) and is present in the upstream 6.2.13 release that TuxCare onboarded. The vulnerable code pattern is not present in the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. Target Spring Framework 6.2.13 is NOT AFFECTED by CVE-2018-1272. The vulnerability involved predictable multipart boundaries due to use of java.util.Random, allowing attackers to inject forged data parts into proxied multipart requests. The target uses SecureRandom (spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java:407) for boundary generation, which is the upstream fix that shipped in Spring Framework 5.0.5/4.3.15 (March 2018). Version 6.2.13 inherited this fix from the upstream release that TuxCare onboarded (commit 819b4ff3b7, \"Onboard version 6.2.13\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Target Spring Framework 6.2.13 is NOT AFFECTED by CVE-2018-1272. The vulnerability involved predictable multipart boundaries due to use of java.util.Random, allowing attackers to inject forged data parts into proxied multipart requests. The target uses SecureRandom (spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java:407) for boundary generation, which is the upstream fix that shipped in Spring Framework 5.0.5/4.3.15 (March 2018). Version 6.2.13 inherited this fix from the upstream release that TuxCare onboarded (commit 819b4ff3b7, \"Onboard version 6.2.13\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:43.996674+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. Target Spring Framework 6.2.13 is not affected by CVE-2018-15756. The fix for this DoS vulnerability (limiting HTTP Range requests to 100 ranges maximum and validating that the sum of range byte counts does not exceed resource length) was authored by upstream Spring Framework developer Rossen Stoyanchev in commit 423aa28ed58 on 2018-10-03. This commit predates the TuxCare onboarding of version 6.2.13, meaning the fix shipped with the upstream release. The vulnerable code pattern (unlimited ranges, no sum validation) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Target Spring Framework 6.2.13 is not affected by CVE-2018-15756. The fix for this DoS vulnerability (limiting HTTP Range requests to 100 ranges maximum and validating that the sum of range byte counts does not exceed resource length) was authored by upstream Spring Framework developer Rossen Stoyanchev in commit 423aa28ed58 on 2018-10-03. This commit predates the TuxCare onboarding of version 6.2.13, meaning the fix shipped with the upstream release. The vulnerable code pattern (unlimited ranges, no sum validation) was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:45:39.779746+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection vulnerability) is NOT present in Spring Framework 6.2.13. The upstream fix commit e9083d7d2053fea3919bfeb9057e9fdba4049119 (\"Apply LogFormatUtils in more places\") was applied in December 2021 and shipped with the upstream 6.2.13 release that TuxCare onboarded. All vulnerable logging patterns now use LogFormatUtils.formatValue() to sanitize user-controlled input bef...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection vulnerability) is NOT present in Spring Framework 6.2.13. The upstream fix commit e9083d7d2053fea3919bfeb9057e9fdba4049119 (\"Apply LogFormatUtils in more places\") was applied in December 2021 and shipped with the upstream 6.2.13 release that TuxCare onboarded. All vulnerable logging patterns now use LogFormatUtils.formatValue() to sanitize user-controlled input bef..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:39:05.782515+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 affects Spring Framework 5.2.0-5.2.17 and 5.3.0-5.3.10, allowing log injection via malicious input containing newlines/control characters. The target (Spring Framework 6.2.13-tuxcare.4) is NOT AFFECTED because the upstream vendor (Spring/VMware) shipped the fix in the 6.2.13 release before TuxCare onboarding. The core defense (LogFormatUtils with regex-based sanitization replacin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 affects Spring Framework 5.2.0-5.2.17 and 5.3.0-5.3.10, allowing log injection via malicious input containing newlines/control characters. The target (Spring Framework 6.2.13-tuxcare.4) is NOT AFFECTED because the upstream vendor (Spring/VMware) shipped the fix in the 6.2.13 release before TuxCare onboarding. The core defense (LogFormatUtils with regex-based sanitization replacin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. CVE-2024-22233 affects Spring Framework 6.0.15 and 6.1.2 with DoS vulnerabilities from malformed forwarded headers and URIs with regex special characters. The target (Spring Framework 6.2.13-tuxcare.4) already contains both upstream fixes (commits 4afac17e58 and 7c9307e970) from December 2023 and January 2024, which were part of the upstream 6.2.13 release that TuxCare onboarded. The vulnerable patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 affects Spring Framework 6.0.15 and 6.1.2 with DoS vulnerabilities from malformed forwarded headers and URIs with regex special characters. The target (Spring Framework 6.2.13-tuxcare.4) already contains both upstream fixes (commits 4afac17e58 and 7c9307e970) from December 2023 and January 2024, which were part of the upstream 6.2.13 release that TuxCare onboarded. The vulnerable patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:17.696488+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-core. CVE-2025-41249 affects Spring Framework's annotation detection mechanism when processing methods in type hierarchies with parameterized super types containing unbounded generics. The vulnerability occurs when ResolvableType.resolve() returns null for unresolved generics, preventing annotation scanners from recognizing method overrides and thus bypassing security annotations like @PreAuthorize. The upstream fix (commit 6d710d482a by Sam Brannen, Aug 2025) changed .resolve() to .toClass() in AnnotatedMethod.isOverrideFor() and AnnotationsScanner.hasSameGenericTypeParameters(), ensuring unresolved generics map to Object.class instead of null. This fix shipped in upstream Spring Framework 6.2.13, which TuxCare onboarded in commit 730f4d1861. The target repository at version 6.2.13 (SHA 0b8d1fbf21) contains this upstream fix and has never been vulnerable to CVE-2025-41249.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "impact_statement": "CVE-2025-41249 affects Spring Framework's annotation detection mechanism when processing methods in type hierarchies with parameterized super types containing unbounded generics. The vulnerability occurs when ResolvableType.resolve() returns null for unresolved generics, preventing annotation scanners from recognizing method overrides and thus bypassing security annotations like @PreAuthorize. The upstream fix (commit 6d710d482a by Sam Brannen, Aug 2025) changed .resolve() to .toClass() in AnnotatedMethod.isOverrideFor() and AnnotationsScanner.hasSameGenericTypeParameters(), ensuring unresolved generics map to Object.class instead of null. This fix shipped in upstream Spring Framework 6.2.13, which TuxCare onboarded in commit 730f4d1861. The target repository at version 6.2.13 (SHA 0b8d1fbf21) contains this upstream fix and has never been vulnerable to CVE-2025-41249.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.2.13-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.2.13-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.2.13-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.2.13-tuxcare.3."
    }
  ]
}