{
  "@id": "urn:uuid:bae14be5-3521-485e-89c5-96416a48aae8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:40:50.837478+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T13:11:00.163144+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes a ReDoS vulnerability in Spring Framework 1.1.0-2.5.6 and 3.0.0.M1-M2 where deserializing regex pointcut objects caused patterns to be recompiled from strings, allowing algorithmic complexity attacks. The vulnerability was fixed in April 2009 (commit 9306d6dbaa) by removing the readObject method and making Pattern arrays non-transient, so patterns are now serialized dire...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes a ReDoS vulnerability in Spring Framework 1.1.0-2.5.6 and 3.0.0.M1-M2 where deserializing regex pointcut objects caused patterns to be recompiled from strings, allowing algorithmic complexity attacks. The vulnerability was fixed in April 2009 (commit 9306d6dbaa) by removing the readObject method and making Pattern arrays non-transient, so patterns are now serialized dire..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:50.837478+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:55:00.073520+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.14 is NOT affected by CVE-2011-2894. The vulnerability targeted Spring 3.0.0-3.0.5 and exploited (1) RMI remoting deserialization of malicious proxy objects and (2) unsafe deserialization of DefaultListableBeanFactory. In version 6.2.14: (1) Spring Remoting (RMI) components have been completely removed; (2) DefaultListableBeanFactory.readObject() explicitly throws NotSerial...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.14 is NOT affected by CVE-2011-2894. The vulnerability targeted Spring 3.0.0-3.0.5 and exploited (1) RMI remoting deserialization of malicious proxy objects and (2) unsafe deserialization of DefaultListableBeanFactory. In version 6.2.14: (1) Spring Remoting (RMI) components have been completely removed; (2) DefaultListableBeanFactory.readObject() explicitly throws NotSerial..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.2.14. The fix for this vulnerability (validating that path prefixes do not contain forward slashes) was introduced by upstream Spring Framework in May 2014 (SPR-11793) and has been present in all Spring Framework versions since 3.2.9 and 4.0.5. The target version 6.2.14, released in 2024, naturally includes thi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.2.14. The fix for this vulnerability (validating that path prefixes do not contain forward slashes) was introduced by upstream Spring Framework in May 2014 (SPR-11793) and has been present in all Spring Framework versions since 3.2.9 and 4.0.5. The target version 6.2.14, released in 2024, naturally includes thi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:21:00.068303+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs. The vulnerability was caused by using AlternativeJdkIdGenerator, which only used SecureRandom for initial seeding, then relied on predictable java.util.Random for all subsequent UUIDs. The fix, introduced in Spring Framework 4.1.5 (January 2015) by commit 52b8f34468, switch...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs. The vulnerability was caused by using AlternativeJdkIdGenerator, which only used SecureRandom for initial seeding, then relied on predictable java.util.Random for all subsequent UUIDs. The fix, introduced in Spring Framework 4.1.5 (January 2015) by commit 52b8f34468, switch..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download/RFD attack) is NOT present in Spring Framework 6.2.14-tuxcare.2. The vulnerability was fixed by upstream Spring Framework in October 2015 (commit 2bd1daa75e by Rossen Stoyanchev). This fix was already included in the upstream Spring 6.2.14 release that TuxCare onboarded in September 2026. The RFD protection is fully implemented in AbstractMessageConverterMethodProcessor.addContentDispositionHeader() which checks file extensions against a whitelist and adds Content-Disposition headers for non-safe extensions, preventing browsers from downloading responses as executable files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download/RFD attack) is NOT present in Spring Framework 6.2.14-tuxcare.2. The vulnerability was fixed by upstream Spring Framework in October 2015 (commit 2bd1daa75e by Rossen Stoyanchev). This fix was already included in the upstream Spring 6.2.14 release that TuxCare onboarded in September 2026. The RFD protection is fully implemented in AbstractMessageConverterMethodProcessor.addContentDispositionHeader() which checks file extensions against a whitelist and adds Content-Disposition headers for non-safe extensions, preventing browsers from downloading responses as executable files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:19:28.539186+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.14 is not affected by CVE-2016-5007. The vulnerability describes pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass when URLs containing special characters (spaces, trailing slashes) are normalized differently. The fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5, \"Introduce HandlerMapping introspection API\", issue SPR-14321) was introduced in Spring Framework 4.3.1 and is present in the upstream 6.2.14 release. The fix provides MatchableHandlerMapping interface and HandlerMappingIntrospector class that expose Spring MVC's internal pattern matching logic to external components like Spring Security, eliminating the discrepancy. Since this upstream fix shipped with the 6.2.14 release (before the first TuxCare onboarding commit 4bc6674c9c), the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 6.2.14 is not affected by CVE-2016-5007. The vulnerability describes pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass when URLs containing special characters (spaces, trailing slashes) are normalized differently. The fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5, \"Introduce HandlerMapping introspection API\", issue SPR-14321) was introduced in Spring Framework 4.3.1 and is present in the upstream 6.2.14 release. The fix provides MatchableHandlerMapping interface and HandlerMappingIntrospector class that expose Spring MVC's internal pattern matching logic to external components like Spring Security, eliminating the discrepancy. Since this upstream fix shipped with the 6.2.14 release (before the first TuxCare onboarding commit 4bc6674c9c), the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:43.517878+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.14 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed by upstream Spring in commit ac37b678a3 (June 2018) as part of Spring Framework 5.1. Spring Framework 6.x (released 2022+) never included JSONP support. The target version 6.2.14 shipped with the upstream fix already applied - there is no JSONP parameter processing, no default \"jsonp\"/\"callback\" trigger names, and the vulnerable classes (AbstractJsonpResponseBodyAdvice, JsonpPollingTransportHandler, etc.) do not exist in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.2.14 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed by upstream Spring in commit ac37b678a3 (June 2018) as part of Spring Framework 5.1. Spring Framework 6.x (released 2022+) never included JSONP support. The target version 6.2.14 shipped with the upstream fix already applied - there is no JSONP parameter processing, no default \"jsonp\"/\"callback\" trigger names, and the vulnerable classes (AbstractJsonpResponseBodyAdvice, JsonpPollingTransportHandler, etc.) do not exist in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:15:16.880365+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework 4.3.x (before 4.3.14) and 5.0.x (before 5.0.3), allowing attackers to bypass security constraints on static resources via URL path parameters with special encodings (duplicate slashes, backslashes, encoded traversal sequences). The target repository (Spring Framework 6.2.14-tuxcare.3) is NOT AFFECTED because the fix was applied by the upstream Spring team ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework 4.3.x (before 4.3.14) and 5.0.x (before 5.0.3), allowing attackers to bypass security constraints on static resources via URL path parameters with special encodings (duplicate slashes, backslashes, encoded traversal sequences). The target repository (Spring Framework 6.2.14-tuxcare.3) is NOT AFFECTED because the fix was applied by the upstream Spring team ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is not present in Spring Framework 6.2.14. The vulnerability allowed attackers to cause a denial-of-service via malicious Spring EL expressions in STOMP subscription selector headers. The upstream fix (commit 5bc80fc094, Spring Framework 6.1.0) disabled selector header processing by default and added null checks, preventing exploitation. This fix was already present in the upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is not present in Spring Framework 6.2.14. The vulnerability allowed attackers to cause a denial-of-service via malicious Spring EL expressions in STOMP subscription selector headers. The upstream fix (commit 5bc80fc094, Spring Framework 6.1.0) disabled selector header processing by default and added null checks, preventing exploitation. This fix was already present in the upstrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 6.2.14 is not affected by CVE-2018-1258. The vulnerability affected Spring Framework 5.0.5 and was fixed in April 2018 (commits aa11721ff0 and eaff2c28a7 by upstream developer Juergen Hoeller). These fixes are present in the upstream 6.2.14 release that TuxCare onboarded. The vulnerable code pattern (improper proxy method resolution that could bypass security annotations) has been removed by the upstream fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "The target Spring Framework 6.2.14 is not affected by CVE-2018-1258. The vulnerability affected Spring Framework 5.0.5 and was fixed in April 2018 (commits aa11721ff0 and eaff2c28a7 by upstream developer Juergen Hoeller). These fixes are present in the upstream 6.2.14 release that TuxCare onboarded. The vulnerable code pattern (improper proxy method resolution that could bypass security annotations) has been removed by the upstream fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:16:00.156571+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 4.3 prior to 4.3.15 and 5.0 prior to 5.0.5, allowing directory traversal via URL-encoded path sequences like %2E%2E (encoded \"..\") on Windows. The target (Spring Framework 6.2.14) is NOT AFFECTED because the upstream vendor already fixed this vulnerability in March 2018 (commit 91b803a231 by jhoeller@pivotal.io), years before the 6.2.14 release. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 4.3 prior to 4.3.15 and 5.0 prior to 5.0.5, allowing directory traversal via URL-encoded path sequences like %2E%2E (encoded \"..\") on Windows. The target (Spring Framework 6.2.14) is NOT AFFECTED because the upstream vendor already fixed this vulnerability in March 2018 (commit 91b803a231 by jhoeller@pivotal.io), years before the 6.2.14 release. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:37:57.932432+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.14 is not affected by CVE-2018-1272. The vulnerability (predictable multipart boundaries due to use of non-cryptographic Random) was fixed in upstream commit ab2410c754 (March 2018, issue SPR-16635) by Rossen Stoyanchev, which replaced `new Random()` with `new SecureRandom()`. This fix was already present in the upstream 6.2.14 release when TuxCare onboarded it in September 2026. The current code uses lazy-initialized SecureRandom via the initRandom() method (line 409), providing cryptographically strong boundary generation that prevents the multipart injection attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.2.14 is not affected by CVE-2018-1272. The vulnerability (predictable multipart boundaries due to use of non-cryptographic Random) was fixed in upstream commit ab2410c754 (March 2018, issue SPR-16635) by Rossen Stoyanchev, which replaced `new Random()` with `new SecureRandom()`. This fix was already present in the upstream 6.2.14 release when TuxCare onboarded it in September 2026. The current code uses lazy-initialized SecureRandom via the initRandom() method (line 409), providing cryptographically strong boundary generation that prevents the multipart injection attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:46:23.146908+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 6.2.14. The vulnerability (DoS via excessive HTTP Range headers) was fixed by upstream Spring in October 2018 (commit 423aa28ed5, issue SPR-17318). The fix adds: (1) MAX_RANGES=100 constant limiting range count, (2) validation throwing IllegalArgumentException if range count exceeds 100, and (3) validation rejecting requests where sum of range lengths >= resource length. All three protections are present and active in the target at lines 48-49, 137-139, and 186-196 of HttpRange.java. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io), shipped in upstream Spring 6.2.14, and onboarded to this TuxCare repository via commit 4bc6674c9c without modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 6.2.14. The vulnerability (DoS via excessive HTTP Range headers) was fixed by upstream Spring in October 2018 (commit 423aa28ed5, issue SPR-17318). The fix adds: (1) MAX_RANGES=100 constant limiting range count, (2) validation throwing IllegalArgumentException if range count exceeds 100, and (3) validation rejecting requests where sum of range lengths >= resource length. All three protections are present and active in the target at lines 48-49, 137-139, and 186-196 of HttpRange.java. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io), shipped in upstream Spring 6.2.14, and onboarded to this TuxCare repository via commit 4bc6674c9c without modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:03:32.627562+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 log injection vulnerability is not present in Spring Framework 6.2.14. The fix was already included in the upstream release before TuxCare onboarded this version. The LogFormatUtils.formatValue() defense mechanism replaces newline characters with &lt;EOL&gt; and control characters with ? before logging user-controlled input, preventing log injection attacks.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 log injection vulnerability is not present in Spring Framework 6.2.14. The fix was already included in the upstream release before TuxCare onboarded this version. The LogFormatUtils.formatValue() defense mechanism replaces newline characters with &lt;EOL&gt; and control characters with ? before logging user-controlled input, preventing log injection attacks."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:44:00.067656+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newline characters) does NOT affect Spring Framework 6.2.14. The vulnerability was fixed in upstream Spring Framework 5.3.11 and 5.2.18 (released October-November 2021). Version 6.2.14, released much later, shipped with the fix already present. The vulnerable logging statements in ResourceWebHandler and ResourceHttpRequestHandler were removed (commit 05ea991d),...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newline characters) does NOT affect Spring Framework 6.2.14. The vulnerability was fixed in upstream Spring Framework 5.3.11 and 5.2.18 (released October-November 2021). Version 6.2.14, released much later, shipped with the fix already present. The vulnerable logging statements in ResourceWebHandler and ResourceHttpRequestHandler were removed (commit 05ea991d),..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.14-tuxcare.3 is not affected by CVE-2024-22233. The CVE describes a DoS vulnerability affecting versions 6.0.15 and 6.1.2 via malformed forwarded headers or URIs containing regex special characters. The target version 6.2.14 already contains both upstream fixes: (1) try-catch block in ForwardedHeaderFilter that returns HTTP 400 on invalid headers, and (2) String.equals() instead of String.matches() in HandlerMappingIntrospector to avoid regex parsing. Both fixes were authored by brian.clozel@broadcom.com and shipped in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Spring Framework 6.2.14-tuxcare.3 is not affected by CVE-2024-22233. The CVE describes a DoS vulnerability affecting versions 6.0.15 and 6.1.2 via malformed forwarded headers or URIs containing regex special characters. The target version 6.2.14 already contains both upstream fixes: (1) try-catch block in ForwardedHeaderFilter that returns HTTP 400 on invalid headers, and (2) String.equals() instead of String.matches() in HandlerMappingIntrospector to avoid regex parsing. Both fixes were authored by brian.clozel@broadcom.com and shipped in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:52.629939+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 6.2.14-tuxcare.2 is NOT affected by CVE-2025-41249. The vulnerability concerns incorrect annotation detection in type hierarchies with unresolved generics, which could lead to authorization bypass when using Spring Security's @EnableMethodSecurity. However, the upstream vendor (Spring) fixed this issue in commits 6d710d482a and 0e3e34bee0, and both fixes were already present in the upstream release 6.2.14 that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "impact_statement": "The target Spring Framework 6.2.14-tuxcare.2 is NOT affected by CVE-2025-41249. The vulnerability concerns incorrect annotation detection in type hierarchies with unresolved generics, which could lead to authorization bypass when using Spring Security's @EnableMethodSecurity. However, the upstream vendor (Spring) fixed this issue in commits 6d710d482a and 0e3e34bee0, and both fixes were already present in the upstream release 6.2.14 that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T07:54:05.746701+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.2.14-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}