{
  "@id": "urn:uuid:d9069364-7955-4e87-9f2e-23519c37fc21",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:38:00.045928+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:38:02.053506+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.15 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in JDK versions before 1.6. Spring Framework 6.2.15 requires JDK 17 as a mandatory runtime environment (confirmed in gradle/toolchains.gradle), which is 11 major versions newer than the affected JDK versions. The regex engine vulnerab...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.15 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in JDK versions before 1.6. Spring Framework 6.2.15 requires JDK 17 as a mandatory runtime environment (confirmed in gradle/toolchains.gradle), which is 11 major versions newer than the affected JDK versions. The regex engine vulnerab..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:38:00.045928+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:46:00.502376+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.15 is not affected by CVE-2011-2894. The vulnerability, which affected versions 3.0.0-3.0.5, was fixed by the upstream Spring team in July 2011. The fix added an acceptProxyClasses flag to ConfigurableObjectInputStream to optionally block deserialization of proxy classes. This fix is present in version 6.2.15, having shipped with the upstream release before TuxCare onboardi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.15 is not affected by CVE-2011-2894. The vulnerability, which affected versions 3.0.0-3.0.5, was fixed by the upstream Spring team in July 2011. The fix added an acceptProxyClasses flag to ConfigurableObjectInputStream to optionally block deserialization of proxy classes. This fix is present in version 6.2.15, having shipped with the upstream release before TuxCare onboardi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target Spring Framework 6.2.15 already contains the upstream vendor fix for CVE-2014-3578. The vulnerability (directory traversal via crafted URL paths with embedded colons) was fixed by Pivotal in May 2014 through commit 8ee465103850a3dca018273fe5952e40d5c45a66. This fix was already present in the upstream 6.2.15 release that TuxCare onboarded (commit 530f923fc0). The vulnerable code pattern (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 Target Spring Framework 6.2.15 already contains the upstream vendor fix for CVE-2014-3578. The vulnerability (directory traversal via crafted URL paths with embedded colons) was fixed by Pivotal in May 2014 through commit 8ee465103850a3dca018273fe5952e40d5c45a66. This fix was already present in the upstream 6.2.15 release that TuxCare onboarded (commit 530f923fc0). The vulnerable code pattern (..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:13:41.066350+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 is NOT present in Spring Framework 6.2.15. The vulnerability concerned predictable session ID generation in the Java SockJS client (versions 4.1.x before 4.1.5). The vulnerable code used AlternativeJdkIdGenerator, which employed SecureRandom only for initial seeding and then used the predictable java.util.Random for subsequent IDs. The fix, introduced in Spring Framework 4.1.5 (Ja...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 is NOT present in Spring Framework 6.2.15. The vulnerability concerned predictable session ID generation in the Java SockJS client (versions 4.1.x before 4.1.5). The vulnerable code used AlternativeJdkIdGenerator, which employed SecureRandom only for initial seeding and then used the predictable java.util.Random for subsequent IDs. The fix, introduced in Spring Framework 4.1.5 (Ja..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:03:12.649222+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.15-tuxcare.8 is not affected by CVE-2015-5211 (Reflected File Download / RFD exploit). The vulnerability was fixed in upstream Spring Framework commit 2bd1daa75e (October 2015) by Rossen Stoyanchev, which added Content-Disposition header protection against RFD attacks. This fix was already present in the upstream 6.2.15 release that TuxCare onboarded. The target contains the complete RFD defense mechanism in AbstractMessageConverterMethodProcessor.java (lines 490-528), including file extension whitelisting, path parameter sanitization, and automatic Content-Disposition header injection for unsafe extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.2.15-tuxcare.8 is not affected by CVE-2015-5211 (Reflected File Download / RFD exploit). The vulnerability was fixed in upstream Spring Framework commit 2bd1daa75e (October 2015) by Rossen Stoyanchev, which added Content-Disposition header protection against RFD attacks. This fix was already present in the upstream 6.2.15 release that TuxCare onboarded. The target contains the complete RFD defense mechanism in AbstractMessageConverterMethodProcessor.java (lines 490-528), including file extension whitelisting, path parameter sanitization, and automatic Content-Disposition header injection for unsafe extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:16:19.686333+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 fix is present in Spring Framework 6.2.15-tuxcare.8. The vulnerability involved inconsistent URL pattern matching between Spring Security and Spring MVC, which could allow authorization bypass. The fix (commit a30ab30e4e) introduced HandlerMappingIntrospector and MatchableHandlerMapping APIs to provide unified pattern matching. This fix was already included in the upstream Spring Framework 6.2.15 release before TuxCare onboarding. All key components (HandlerMappingIntrospector, MatchableHandlerMapping interface, RequestMatchResult, and their implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping) are present in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 fix is present in Spring Framework 6.2.15-tuxcare.8. The vulnerability involved inconsistent URL pattern matching between Spring Security and Spring MVC, which could allow authorization bypass. The fix (commit a30ab30e4e) introduced HandlerMappingIntrospector and MatchableHandlerMapping APIs to provide unified pattern matching. This fix was already included in the upstream Spring Framework 6.2.15 release before TuxCare onboarding. All key components (HandlerMappingIntrospector, MatchableHandlerMapping interface, RequestMatchResult, and their implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping) are present in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:57:37.191155+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.15-tuxcare.8 is NOT AFFECTED by CVE-2018-11040. JSONP support was completely removed by upstream commit ac37b678a3 (June 7, 2018) authored by Sebastien Deleuze, predating the TuxCare onboarding of version 6.2.15. The vulnerable code pattern (MappingJackson2JsonView's jsonpParameterNames field with default [\"jsonp\", \"callback\"] values) does not exist in the target. MappingJackson2JsonView.java contains no JSONP functionality whatsoever. AbstractJsonpResponseBodyAdvice.java was deleted entirely. The removal shipped in the upstream 6.2.15 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.2.15-tuxcare.8 is NOT AFFECTED by CVE-2018-11040. JSONP support was completely removed by upstream commit ac37b678a3 (June 7, 2018) authored by Sebastien Deleuze, predating the TuxCare onboarding of version 6.2.15. The vulnerable code pattern (MappingJackson2JsonView's jsonpParameterNames field with default [\"jsonp\", \"callback\"] values) does not exist in the target. MappingJackson2JsonView.java contains no JSONP functionality whatsoever. AbstractJsonpResponseBodyAdvice.java was deleted entirely. The removal shipped in the upstream 6.2.15 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:07:00.075690+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 6.2.15. The vulnerability allowed attackers to bypass security constraints on static resources using specially encoded path parameters (e.g., %2F%2F%2E%2E%2F%2F becoming //../..//). The fix was already included in the upstream Spring Framework 6.2.15 release before TuxCare onboarded it. The target code contains comprehensive path normalization an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 6.2.15. The vulnerability allowed attackers to bypass security constraints on static resources using specially encoded path parameters (e.g., %2F%2F%2E%2E%2F%2F becoming //../..//). The fix was already included in the upstream Spring Framework 6.2.15 release before TuxCare onboarded it. The target code contains comprehensive path normalization an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 6.2.15-tuxcare.8. The vulnerability (regex DoS via malicious selector headers in STOMP messaging) was fixed in upstream Spring Framework 4.3.17/5.0.6 (April 2018). The fix adds a null check before parsing selector headers and makes the feature configurable. In version 6.x, the feature is disabled by default, providing even stronger protection. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 6.2.15-tuxcare.8. The vulnerability (regex DoS via malicious selector headers in STOMP messaging) was fixed in upstream Spring Framework 4.3.17/5.0.6 (April 2018). The fix adds a null check before parsing selector headers and makes the feature configurable. In version 6.x, the feature is disabled by default, providing even stronger protection. Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 with an authorization bypass vulnerability in method security when using proxies. The target repository (Spring Framework 6.2.15-tuxcare.8) is NOT AFFECTED because the upstream fix was already present in the Spring Framework 6.2.15 release when TuxCare onboarded it. The vulnerable code pattern has been removed by upstream commit aa11721 (April 2018), which is an ancestor of the onboarding commit 530f923fc0e. All affected files (AopUtils.java, AnnotationMethodMatcher.java, AspectJExpressionPointcut.java, CacheAspectSupport.java, ApplicationListenerMethodAdapter.java, EventExpressionEvaluator.java) contain the patched code that properly handles proxy method resolution for security annotations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 with an authorization bypass vulnerability in method security when using proxies. The target repository (Spring Framework 6.2.15-tuxcare.8) is NOT AFFECTED because the upstream fix was already present in the Spring Framework 6.2.15 release when TuxCare onboarded it. The vulnerable code pattern has been removed by upstream commit aa11721 (April 2018), which is an ancestor of the onboarding commit 530f923fc0e. All affected files (AopUtils.java, AnnotationMethodMatcher.java, AspectJExpressionPointcut.java, CacheAspectSupport.java, ApplicationListenerMethodAdapter.java, EventExpressionEvaluator.java) contain the patched code that properly handles proxy method resolution for security annotations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:50:00.206758+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 6.2.15. The fix was already shipped in the upstream release before TuxCare onboarded version 6.2.15. All defense mechanisms (path normalization, duplicate slash removal, and encoded path traversal detection) are present and active in the code via the ResourceHandlerUtils utility class.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 6.2.15. The fix was already shipped in the upstream release before TuxCare onboarded version 6.2.15. All defense mechanisms (path normalization, duplicate slash removal, and encoded path traversal detection) are present and active in the code via the ResourceHandlerUtils utility class."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 describes a multipart boundary injection vulnerability in Spring Framework versions prior to 5.0.5 and 4.3.15. The vulnerability occurs when multipart boundaries are generated using predictable java.util.Random, allowing attackers to predict boundaries and inject malicious multipart sections. The vendor fix (commit ab2410c754, March 2018) replaced Random with SecureRandom. This fix was authored by upstream Spring developer Rossen Stoyanchev (rstoyanchev@pivotal.io) and was already present in Spring Framework 6.2.15 when TuxCare onboarded it (commit 530f923fc0). The current code uses lazy initialization with SecureRandom (MimeTypeUtils.java:409), making boundaries cryptographically unpredictable. Target version 6.2.15-tuxcare.8 is NOT AFFECTED because the vulnerable pattern (predictable Random) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 describes a multipart boundary injection vulnerability in Spring Framework versions prior to 5.0.5 and 4.3.15. The vulnerability occurs when multipart boundaries are generated using predictable java.util.Random, allowing attackers to predict boundaries and inject malicious multipart sections. The vendor fix (commit ab2410c754, March 2018) replaced Random with SecureRandom. This fix was authored by upstream Spring developer Rossen Stoyanchev (rstoyanchev@pivotal.io) and was already present in Spring Framework 6.2.15 when TuxCare onboarded it (commit 530f923fc0). The current code uses lazy initialization with SecureRandom (MimeTypeUtils.java:409), making boundaries cryptographically unpredictable. Target version 6.2.15-tuxcare.8 is NOT AFFECTED because the vulnerable pattern (predictable Random) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:40:32.377029+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 (Spring Framework HTTP Range DoS) is NOT AFFECTING version 6.2.15. The upstream vendor fix (commit 423aa28ed5 by Rossen Stoyanchev) that adds MAX_RANGES=100 limit and sum validation was already present in Spring Framework 6.2.15 when TuxCare onboarded it. The vulnerable pattern (unbounded range processing) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 (Spring Framework HTTP Range DoS) is NOT AFFECTING version 6.2.15. The upstream vendor fix (commit 423aa28ed5 by Rossen Stoyanchev) that adds MAX_RANGES=100 limit and sum validation was already present in Spring Framework 6.2.15 when TuxCare onboarded it. The vulnerable pattern (unbounded range processing) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:18.186955+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection) is not present in Spring Framework 6.2.15-tuxcare.8. The upstream fix (commit e9083d7d2053fea3919bfeb9057e9fdba4049119 by rstoyanchev@vmware.com, dated 2021-12-09) was already included in the upstream Spring Framework 6.2.15 release that TuxCare onboarded. The fix wraps all user-controlled input in log statements with LogFormatUtils.formatValue() to prevent log in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection) is not present in Spring Framework 6.2.15-tuxcare.8. The upstream fix (commit e9083d7d2053fea3919bfeb9057e9fdba4049119 by rstoyanchev@vmware.com, dated 2021-12-09) was already included in the upstream Spring Framework 6.2.15 release that TuxCare onboarded. The fix wraps all user-controlled input in log statements with LogFormatUtils.formatValue() to prevent log in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:31:11.048648+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 is a log injection vulnerability allowing attackers to inject newline and control characters into log messages to forge fake log entries. The fix adds regex-based sanitization in LogFormatUtils.formatValue() that replaces newlines with `<EOL>` and control characters with `?`. This fix is present in the target Spring Framework 6.2.15 and was introduced by upstream commit 99c7608ff...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 is a log injection vulnerability allowing attackers to inject newline and control characters into log messages to forge fake log entries. The fix adds regex-based sanitization in LogFormatUtils.formatValue() that replaces newlines with `<EOL>` and control characters with `?`. This fix is present in the target Spring Framework 6.2.15 and was introduced by upstream commit 99c7608ff..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. CVE-2024-22233 affects Spring Framework versions 6.0.15 and 6.1.2 with two DoS vulnerabilities: (1) malformed forwarded headers causing unhandled exceptions, and (2) URIs with regex metacharacters causing PatternSyntaxException. The target repository (Spring Framework 6.2.15-tuxcare.8) is not affected because both vulnerabilities were already fixed in the upstream 6.2.15 release before TuxCare onboarded it. The fixes were authored by brian.clozel@broadcom.com (upstream Spring developer) in December 2023 and January 2024, and are present in the target at commit 4afac17e58 (ForwardedHeaderFilter) and 7c9307e970 (HandlerMappingIntrospector).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 affects Spring Framework versions 6.0.15 and 6.1.2 with two DoS vulnerabilities: (1) malformed forwarded headers causing unhandled exceptions, and (2) URIs with regex metacharacters causing PatternSyntaxException. The target repository (Spring Framework 6.2.15-tuxcare.8) is not affected because both vulnerabilities were already fixed in the upstream 6.2.15 release before TuxCare onboarded it. The fixes were authored by brian.clozel@broadcom.com (upstream Spring developer) in December 2023 and January 2024, and are present in the target at commit 4afac17e58 (ForwardedHeaderFilter) and 7c9307e970 (HandlerMappingIntrospector).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:17.696488+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 does not affect version 6.2.15-tuxcare.2 of org.springframework:spring-core. CVE-2025-41249 is NOT present in Spring Framework 6.2.15-tuxcare.8. The vulnerability was already fixed in the upstream Spring Framework 6.2.15 release before TuxCare onboarded it. Both upstream fix commits (6d710d482a and 0e3e34bee0) are ancestors of the TuxCare onboarding commit (530f923fc0), confirming the fixes shipped with the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "impact_statement": "CVE-2025-41249 is NOT present in Spring Framework 6.2.15-tuxcare.8. The vulnerability was already fixed in the upstream Spring Framework 6.2.15 release before TuxCare onboarded it. Both upstream fix commits (6d710d482a and 0e3e34bee0) are ancestors of the TuxCare onboarding commit (530f923fc0), confirming the fixes shipped with the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.15-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.2.15-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.2.15-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.2.15-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.2.15-tuxcare.7."
    }
  ]
}