{
  "@id": "urn:uuid:fe0b5881-892b-4dd5-b0d6-4e998d69bc14",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:37:00.050625+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:38:02.053506+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 targets Spring Framework 1.1.0-2.5.6 and early 3.0 milestones, involving regex DoS through deserialization of JdkRegexpMethodPointcut objects. While Spring 6.2.19 contains the serializable JdkRegexpMethodPointcut class with Pattern fields that could theoretically trigger CPU exhaustion if deserialized with pathological patterns, there is no reachable code path in modern Spring Fra...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 targets Spring Framework 1.1.0-2.5.6 and early 3.0 milestones, involving regex DoS through deserialization of JdkRegexpMethodPointcut objects. While Spring 6.2.19 contains the serializable JdkRegexpMethodPointcut class with Pattern fields that could theoretically trigger CPU exhaustion if deserialized with pathological patterns, there is no reachable code path in modern Spring Fra..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:37:00.050625+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 6.2.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 6.2.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:46:00.502376+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe proxy class deserialization. The target version 6.2.19 is NOT AFFECTED because the upstream vendor (Spring/VMware) fixed this vulnerability in July 2011 by adding acceptProxyClasses protection to ConfigurableObjectInputStream. The fix (commit 7d8aa05c40) was already present in the upstream Spring Framework 6.2.19 release before TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe proxy class deserialization. The target version 6.2.19 is NOT AFFECTED because the upstream vendor (Spring/VMware) fixed this vulnerability in July 2011 by adding acceptProxyClasses protection to ConfigurableObjectInputStream. The fix (commit 7d8aa05c40) was already present in the upstream Spring Framework 6.2.19 release before TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in Spring Framework 6.2.19-tuxcare.3. The fix was already included in upstream Spring Framework 6.2.19 before TuxCare onboarded this version. The defensive code in StringUtils.cleanPath() (lines 739-741) validates that path prefixes do not contain directory separators, preventing the attack where crafted URLs with embedded colons (e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in Spring Framework 6.2.19-tuxcare.3. The fix was already included in upstream Spring Framework 6.2.19 before TuxCare onboarded this version. The defensive code in StringUtils.cleanPath() (lines 739-741) validates that path prefixes do not contain directory separators, preventing the attack where crafted URLs with embedded colons (e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:13:41.066350+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used SecureRandom only for initial seed, then predictable java.util.Random). The target version 6.2.19 uses JdkIdGenerator with UUID.randomUUID() (cryptographically secure). The fix was introduced in commit 52b8f344 by upstream author rs...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used SecureRandom only for initial seed, then predictable java.util.Random). The target version 6.2.19 uses JdkIdGenerator with UUID.randomUUID() (cryptographically secure). The fix was introduced in commit 52b8f344 by upstream author rs..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:03:12.649222+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 6.2.19-tuxcare.3 is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). The upstream fix for this CVE (commit 2bd1daa75e \"Protect against RFD exploits\") is present in the target and was already included in the upstream Spring Framework 6.2.19 release that TuxCare onboarded. The complete RFD defense mechanism exists in AbstractMessageConverterMethodProcessor.java, including: (1) SAFE_EXTENSIONS whitelist covering txt, text, yml, properties, csv, json, xml, atom, rss, png, jpe, jpeg, jpg, gif, wbmp, bmp; (2) addContentDispositionHeader method that adds \"Content-Disposition: inline;filename=f.txt\" header when dangerous extensions are detected in either the URL path or path parameters; (3) safeExtension method that validates extensions against the whitelist, handler patterns, and safe media types. This is an upstream-authored fix (author rstoyanchev@pivotal.io, not a TuxCare domain), so the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "The target Spring Framework 6.2.19-tuxcare.3 is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). The upstream fix for this CVE (commit 2bd1daa75e \"Protect against RFD exploits\") is present in the target and was already included in the upstream Spring Framework 6.2.19 release that TuxCare onboarded. The complete RFD defense mechanism exists in AbstractMessageConverterMethodProcessor.java, including: (1) SAFE_EXTENSIONS whitelist covering txt, text, yml, properties, csv, json, xml, atom, rss, png, jpe, jpeg, jpg, gif, wbmp, bmp; (2) addContentDispositionHeader method that adds \"Content-Disposition: inline;filename=f.txt\" header when dangerous extensions are detected in either the URL path or path parameters; (3) safeExtension method that validates extensions against the whitelist, handler patterns, and safe media types. This is an upstream-authored fix (author rstoyanchev@pivotal.io, not a TuxCare domain), so the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:15:34.961054+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security and Spring MVC that could allow authorization bypass. The vulnerability was fixed in Spring Framework 4.3.1 (May 2016) through the introduction of the HandlerMappingIntrospector API. The target version 6.2.19 already contains this fix, which shipped with the upstream release before TuxCare onboarded the version. The vulnerable pattern (lack of consistent pattern matching API) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security and Spring MVC that could allow authorization bypass. The vulnerability was fixed in Spring Framework 4.3.1 (May 2016) through the introduction of the HandlerMappingIntrospector API. The target version 6.2.19 already contains this fix, which shipped with the upstream release before TuxCare onboarded the version. The vulnerable pattern (lack of consistent pattern matching API) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:57:37.191155+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.19-tuxcare.3 is NOT affected by CVE-2018-11040. The entire JSONP feature was removed from Spring Framework in version 5.1 (June 2018) by upstream commit ac37b678a3. The vulnerable code pattern (MappingJackson2JsonView with default jsonpParameterNames set to \"jsonp\" and \"callback\") does not exist in this version. Version 6.2.19 never had JSONP support\u2014it was removed from the upstream codebase before this version was released. The fix is an upstream change by Sebastien Deleuze (sdeleuze@pivotal.io), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.2.19-tuxcare.3 is NOT affected by CVE-2018-11040. The entire JSONP feature was removed from Spring Framework in version 5.1 (June 2018) by upstream commit ac37b678a3. The vulnerable code pattern (MappingJackson2JsonView with default jsonpParameterNames set to \"jsonp\" and \"callback\") does not exist in this version. Version 6.2.19 never had JSONP support\u2014it was removed from the upstream codebase before this version was released. The fix is an upstream change by Sebastien Deleuze (sdeleuze@pivotal.io), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:07:00.075690+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.19 is NOT affected by CVE-2018-1199. The vulnerability allowed attackers to bypass security constraints by using percent-encoded path traversal sequences (e.g., %2E%2E%2F for \"../\") or non-normalized separators in URL paths to access static resources outside configured directories. The upstream Spring Framework team fixed this in SPR-16616 by adding URL decoding, separator ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.19 is NOT affected by CVE-2018-1199. The vulnerability allowed attackers to bypass security constraints by using percent-encoded path traversal sequences (e.g., %2E%2E%2F for \"../\") or non-normalized separators in URL paths to access static resources outside configured directories. The upstream Spring Framework team fixed this in SPR-16616 by adding URL decoding, separator ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions that allow untrusted Spring EL expression parsing via the selector header in STOMP WebSocket messaging. The target version 6.2.19 includes upstream commit 5bc80fc094 (authored by Sam Brannen, June 2023) which disables the selector header feature by default. The selectorHeaderName field is initialized to null instead of \"selector\", and the code inc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions that allow untrusted Spring EL expression parsing via the selector header in STOMP WebSocket messaging. The target version 6.2.19 includes upstream commit 5bc80fc094 (authored by Sam Brannen, June 2023) which disables the selector header feature by default. The selectorHeaderName field is initialized to null instead of \"selector\", and the code inc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 authorization bypass vulnerability is NOT present in Spring Framework 6.2.19-tuxcare.3. The vulnerability affected version 5.0.5 where AopUtils.getMostSpecificMethod() excluded proxy classes from method resolution, causing security annotations to be bypassed. The upstream fix (commit aa11721ff0f by Juergen Hoeller, April 2018) removed the problematic !Proxy.isProxyClass(targetClass) check and was already present in the upstream 6.2.19 release that TuxCare onboarded. The target code at spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:213 correctly processes proxy classes without exclusion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 authorization bypass vulnerability is NOT present in Spring Framework 6.2.19-tuxcare.3. The vulnerability affected version 5.0.5 where AopUtils.getMostSpecificMethod() excluded proxy classes from method resolution, causing security annotations to be bypassed. The upstream fix (commit aa11721ff0f by Juergen Hoeller, April 2018) removed the problematic !Proxy.isProxyClass(targetClass) check and was already present in the upstream 6.2.19 release that TuxCare onboarded. The target code at spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:213 correctly processes proxy classes without exclusion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:50:00.206758+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.19-tuxcare.3 is NOT vulnerable to CVE-2018-1271. The fix for this directory traversal vulnerability was already present in the upstream Spring Framework 6.2.19 release before TuxCare onboarded it. The defense mechanisms include URL-decoding paths and rejecting those containing encoded traversal sequences (\"../\" or \"..\\\"), normalizing backslashes to forward slashes, and vali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.19-tuxcare.3 is NOT vulnerable to CVE-2018-1271. The fix for this directory traversal vulnerability was already present in the upstream Spring Framework 6.2.19 release before TuxCare onboarded it. The defense mechanisms include URL-decoding paths and rejecting those containing encoded traversal sequences (\"../\" or \"..\\\"), normalizing backslashes to forward slashes, and vali..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:11.887724+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 describes a vulnerability where predictable multipart boundary generation allows attackers to inject additional multipart sections, potentially leading to privilege escalation. The vulnerability stems from using java.util.Random instead of SecureRandom for boundary generation in MimeTypeUtils. The target Spring Framework 6.2.19-tuxcare.3 is NOT AFFECTED because the fix (using SecureRandom) was already present in the upstream 6.2.19 release before TuxCare onboarded it. The fix was committed by upstream Spring author Rossen Stoyanchev (rstoyanchev@pivotal.io) in March 2018, and all multipart boundary generation paths in the target delegate to the secure implementation with no alternative vulnerable code paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 describes a vulnerability where predictable multipart boundary generation allows attackers to inject additional multipart sections, potentially leading to privilege escalation. The vulnerability stems from using java.util.Random instead of SecureRandom for boundary generation in MimeTypeUtils. The target Spring Framework 6.2.19-tuxcare.3 is NOT AFFECTED because the fix (using SecureRandom) was already present in the upstream 6.2.19 release before TuxCare onboarded it. The fix was committed by upstream Spring author Rossen Stoyanchev (rstoyanchev@pivotal.io) in March 2018, and all multipart boundary generation paths in the target delegate to the secure implementation with no alternative vulnerable code paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:40:32.377029+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.19 is not affected by CVE-2018-15756. The vulnerability affected versions 5.1, 5.0.x < 5.0.10, 4.3.x < 4.3.20, and older 4.2.x. The fix (MAX_RANGES = 100 validation and sum-of-ranges validation) was introduced upstream in October 2018 and shipped with Spring Framework 6.2.19. TuxCare onboarded version 6.2.19 with the fix already present; no TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.2.19 is not affected by CVE-2018-15756. The vulnerability affected versions 5.1, 5.0.x < 5.0.10, 4.3.x < 4.3.20, and older 4.2.x. The fix (MAX_RANGES = 100 validation and sum-of-ranges validation) was introduced upstream in October 2018 and shipped with Spring Framework 6.2.19. TuxCare onboarded version 6.2.19 with the fix already present; no TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:40:57.563938+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 is a log injection vulnerability where user-controlled strings containing newline or control characters can inject additional log entries. The upstream Spring Framework fix (commits e9083d7d and 99c7608f) introduced LogFormatUtils.formatValue() to sanitize user input before logging by replacing newlines with <EOL> and control characters with ?. The target repository Spring Framew...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 is a log injection vulnerability where user-controlled strings containing newline or control characters can inject additional log entries. The upstream Spring Framework fix (commits e9083d7d and 99c7608f) introduced LogFormatUtils.formatValue() to sanitize user input before logging by replacing newlines with <EOL> and control characters with ?. The target repository Spring Framew..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:30:04.366972+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection vulnerability) is NOT present in spring-framework 6.2.19-tuxcare.3. The upstream fix was already included in Spring Framework 6.2.19 before TuxCare onboarded it. The fix adds LogFormatUtils sanitization that replaces newline characters with &lt;EOL&gt; and control characters with ? before logging, preventing log injection attacks. The vulnerable pattern (unsanitize...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection vulnerability) is NOT present in spring-framework 6.2.19-tuxcare.3. The upstream fix was already included in Spring Framework 6.2.19 before TuxCare onboarded it. The fix adds LogFormatUtils sanitization that replaces newline characters with &lt;EOL&gt; and control characters with ? before logging, preventing log injection attacks. The vulnerable pattern (unsanitize..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. CVE-2024-22233 affects Spring Framework 6.0.15 and 6.1.2 via two DoS vectors: (1) HandlerMappingIntrospector using String.matches() instead of String.equals() for URI comparison, causing PatternSyntaxException with regex metacharacters in URIs; (2) ForwardedHeaderFilter throwing unhandled exceptions on malformed forwarded headers. The target (Spring Framework 6.2.19) contains both fixes, authored by upstream maintainer brian.clozel@broadcom.com and shipped in the upstream 6.2.19 release prior to TuxCare onboarding. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 affects Spring Framework 6.0.15 and 6.1.2 via two DoS vectors: (1) HandlerMappingIntrospector using String.matches() instead of String.equals() for URI comparison, causing PatternSyntaxException with regex metacharacters in URIs; (2) ForwardedHeaderFilter throwing unhandled exceptions on malformed forwarded headers. The target (Spring Framework 6.2.19) contains both fixes, authored by upstream maintainer brian.clozel@broadcom.com and shipped in the upstream 6.2.19 release prior to TuxCare onboarding. The vulnerable code patterns are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:17.696488+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. Target Spring Framework 6.2.19 is not affected by CVE-2025-41249. The vulnerability concerned incorrect annotation detection in type hierarchies with unbounded generics, which could cause security annotations to be bypassed. However, the fix (using ResolvableType.toClass() instead of resolve() and scanning declared methods) was already present in the upstream Spring Framework 6.2.19 release that TuxCare onboarded in July 2026. The fix commits (6d710d482a and 0e3e34bee0) were authored by upstream maintainer Sam Brannen in August-September 2025 and shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "impact_statement": "Target Spring Framework 6.2.19 is not affected by CVE-2025-41249. The vulnerability concerned incorrect annotation detection in type hierarchies with unbounded generics, which could cause security annotations to be bypassed. However, the fix (using ResolvableType.toClass() instead of resolve() and scanning declared methods) was already present in the upstream Spring Framework 6.2.19 release that TuxCare onboarded in July 2026. The fix commits (6d710d482a and 0e3e34bee0) were authored by upstream maintainer Sam Brannen in August-September 2025 and shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-12T20:16:00.118732+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2026-41848 (ReDoS in AntPathMatcher) is NOT present in Spring Framework 6.2.19. The upstream vendor fix (commit b294371a46 by Sam Brannen) is already included in the upstream 6.2.19 release that TuxCare onboarded. The fix introduces a MaxAttemptsCharSequence wrapper that limits regex matcher character access to 1,000,000 attempts, preventing unbounded CPU consumption from malicious patterns.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-41848 (ReDoS in AntPathMatcher) is NOT present in Spring Framework 6.2.19. The upstream vendor fix (commit b294371a46 by Sam Brannen) is already included in the upstream 6.2.19 release that TuxCare onboarded. The fix introduces a MaxAttemptsCharSequence wrapper that limits regex matcher character access to 1,000,000 attempts, preventing unbounded CPU consumption from malicious patterns."
    }
  ]
}