{
  "@id": "urn:uuid:8cdbb23f-9420-4bcc-86f4-4bd57ffb1254",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 49,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:33:50.494474+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:25:46.380992+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is not applicable to Spring Framework 6.2.3. The vulnerability existed in JDK versions before 1.6 (released 2006), affecting the java.util.regex.Pattern.compile method's regex engine which could experience catastrophic backtracking with certain patterns. Spring Framework 6.2.3 requires Java 17 (confirmed in build.gradle sourceCompatibility/targetCompatibility = 17), which is many ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is not applicable to Spring Framework 6.2.3. The vulnerability existed in JDK versions before 1.6 (released 2006), affecting the java.util.regex.Pattern.compile method's regex engine which could experience catastrophic backtracking with certain patterns. Spring Framework 6.2.3 requires Java 17 (confirmed in build.gradle sourceCompatibility/targetCompatibility = 17), which is many ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:33:50.494474+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 6.2.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 6.2.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:43:00.134280+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via deserialization of malicious proxy classes in RMI remoting components. The target version 6.2.3-tuxcare.4 is NOT AFFECTED due to two upstream fixes: (1) 2011 fix added acceptProxyClasses defense to ConfigurableObjectInputStream (commit 7d8aa05c40); (2) 2021 removal of all RPC-style remoting classes including CodebaseAwareObjectInputStream a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via deserialization of malicious proxy classes in RMI remoting components. The target version 6.2.3-tuxcare.4 is NOT AFFECTED due to two upstream fixes: (1) 2011 fix added acceptProxyClasses defense to ConfigurableObjectInputStream (commit 7d8aa05c40); (2) 2021 removal of all RPC-style remoting classes including CodebaseAwareObjectInputStream a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.2.3-tuxcare.4. The upstream fix (commit 8ee4651038) was already included in the upstream release that TuxCare onboarded. The fix prevents incorrect prefix extraction when colon characters appear in path components by checking if the detected prefix contains a forward slash, thereby blocking path traversal explo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.2.3-tuxcare.4. The upstream fix (commit 8ee4651038) was already included in the upstream release that TuxCare onboarded. The fix prevents incorrect prefix extraction when colon characters appear in path components by checking if the detected prefix contains a forward slash, thereby blocking path traversal explo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:54.717747+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.3-tuxcare.4 is not affected by CVE-2015-0201. The vulnerability (predictable session IDs in the Java SockJS client) existed in Spring Framework 4.1.x before 4.1.5, where AlternativeJdkIdGenerator used a predictable java.util.Random seeded once with SecureRandom. The fix, introduced in Spring Framework 4.1.5 by upstream developer Rossen Stoyanchev (commit 52b8f34468, January...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.3-tuxcare.4 is not affected by CVE-2015-0201. The vulnerability (predictable session IDs in the Java SockJS client) existed in Spring Framework 4.1.x before 4.1.5, where AlternativeJdkIdGenerator used a predictable java.util.Random seeded once with SecureRandom. The fix, introduced in Spring Framework 4.1.5 by upstream developer Rossen Stoyanchev (commit 52b8f34468, January..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:01:12.948527+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT PRESENT in Spring Framework 6.2.3-tuxcare.3. The vulnerability pattern does not exist because the upstream fix (commit 2bd1daa75e by rstoyanchev@pivotal.io) was already included in the Spring Framework 6.2.3 release that TuxCare onboarded. The target contains complete RFD protection via Content-Disposition header controls and safe extension whitelisting in AbstractMessageConverterMethodProcessor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT PRESENT in Spring Framework 6.2.3-tuxcare.3. The vulnerability pattern does not exist because the upstream fix (commit 2bd1daa75e by rstoyanchev@pivotal.io) was already included in the Spring Framework 6.2.3 release that TuxCare onboarded. The target contains complete RFD protection via Content-Disposition header controls and safe extension whitelisting in AbstractMessageConverterMethodProcessor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:59.149107+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security and Spring MVC. The upstream fix (commit a30ab30e4e) introduced HandlerMappingIntrospector, MatchableHandlerMapping interface, and RequestMatchResult to provide a uniform introspection API allowing Spring Security to use the same pattern matching logic as Spring MVC. This fix was already present in Spring Framework 6.2.3 upstream release before TuxCare onboarding (first TuxCare commit cbda719a7f). All defense components are present and functional in the target: MatchableHandlerMapping interface exists with match() method, AbstractUrlHandlerMapping implements it with functional pattern matching using getPathMatcher(), HandlerMappingIntrospector provides the introspection API, and RequestMatchResult class handles match results. The target is not affected because the vulnerable pattern (inconsistent pattern matching leading to authorization bypass) was eliminated by the upstream fix that shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security and Spring MVC. The upstream fix (commit a30ab30e4e) introduced HandlerMappingIntrospector, MatchableHandlerMapping interface, and RequestMatchResult to provide a uniform introspection API allowing Spring Security to use the same pattern matching logic as Spring MVC. This fix was already present in Spring Framework 6.2.3 upstream release before TuxCare onboarding (first TuxCare commit cbda719a7f). All defense components are present and functional in the target: MatchableHandlerMapping interface exists with match() method, AbstractUrlHandlerMapping implements it with functional pattern matching using getPathMatcher(), HandlerMappingIntrospector provides the introspection API, and RequestMatchResult class handles match results. The target is not affected because the vulnerable pattern (inconsistent pattern matching leading to authorization bypass) was eliminated by the upstream fix that shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:55:21.996343+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 due to JSONP support being automatically enabled via \"jsonp\" and \"callback\" query parameters in MappingJackson2JsonView. The target version 6.2.3-tuxcare.3 is NOT affected because the entire JSONP functionality was completely removed by upstream in commit ac37b678a3 (June 2018), which was already present in the upstream release before TuxCare made any modifications. The current codebase contains no JSONP-related code, no jsonpParameterNames field, no callback parameter handling, and no mechanism to wrap JSON output in callback functions for cross-domain requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 due to JSONP support being automatically enabled via \"jsonp\" and \"callback\" query parameters in MappingJackson2JsonView. The target version 6.2.3-tuxcare.3 is NOT affected because the entire JSONP functionality was completely removed by upstream in commit ac37b678a3 (June 2018), which was already present in the upstream release before TuxCare made any modifications. The current codebase contains no JSONP-related code, no jsonpParameterNames field, no callback parameter handling, and no mechanism to wrap JSON output in callback functions for cross-domain requests.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:06:00.110833+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The target version 6.2.3-tuxcare.4 is substantially newer and contains the upstream fixes applied in March 2018. The vulnerability involved URL path parameters (semicolon content) bypassing security constraints due to inconsistent handling across servlet containers. The upstream fix introduced path norma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The target version 6.2.3-tuxcare.4 is substantially newer and contains the upstream fixes applied in March 2018. The vulnerability involved URL path parameters (semicolon content) bypassing security constraints due to inconsistent handling across servlet containers. The upstream fix introduced path norma..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T09:10:31.335583+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. The target repository (Spring Framework 6.2.3-tuxcare.4) is NOT affected by CVE-2018-1258. The vulnerability involved incorrect method resolution when dealing with JDK dynamic proxies, causing security annotations to be bypassed. The fix was introduced upstream by Juergen Hoeller in commit aa11721ff0 (April 2018) and was already present in the upstream Spring Framework 6.2.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "The target repository (Spring Framework 6.2.3-tuxcare.4) is NOT affected by CVE-2018-1258. The vulnerability involved incorrect method resolution when dealing with JDK dynamic proxies, causing security annotations to be bypassed. The fix was introduced upstream by Juergen Hoeller in commit aa11721ff0 (April 2018) and was already present in the upstream Spring Framework 6.2.3 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:43:00.134660+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2018-1271. The directory traversal vulnerability fix was already present in the upstream release. The fix validates URL-decoded paths to reject those containing \"../\" or \"..\\\\\" (Windows backslash variant), preventing path traversal attacks when serving static resources from the filesystem. The vulnerable code pattern does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2018-1271. The directory traversal vulnerability fix was already present in the upstream release. The fix validates URL-decoded paths to reject those containing \"../\" or \"..\\\\\" (Windows backslash variant), preventing path traversal attacks when serving static resources from the filesystem. The vulnerable code pattern does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 is NOT present in Spring Framework 6.2.3. The vulnerability involved predictable Random() used for multipart boundary generation, allowing attackers to predict boundaries and inject malicious multipart sections for privilege escalation. The upstream fix (commit ab2410c754 by rstoyanchev@pivotal.io) replaced Random with SecureRandom, and this fix was already included in the upstream Spring Framework 6.2.3 release that TuxCare onboarded. Current code uses SecureRandom via lazy initialization (line 409 of MimeTypeUtils.java), and all multipart boundary generation delegates to this single secure implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in Spring Framework 6.2.3. The vulnerability involved predictable Random() used for multipart boundary generation, allowing attackers to predict boundaries and inject malicious multipart sections for privilege escalation. The upstream fix (commit ab2410c754 by rstoyanchev@pivotal.io) replaced Random with SecureRandom, and this fix was already included in the upstream Spring Framework 6.2.3 release that TuxCare onboarded. Current code uses SecureRandom via lazy initialization (line 409 of MimeTypeUtils.java), and all multipart boundary generation delegates to this single secure implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:59.528750+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.3 is not affected by CVE-2018-15756. The vulnerability (DoS via malicious HTTP Range headers with excessive or overlapping ranges) was fixed in upstream commit 423aa28ed5 by Rossen Stoyanchev (rstoyanchev@pivotal.io) on Oct 3, 2018. This fix was already present in the upstream 6.2.3 release that TuxCare onboarded. Both required defenses are implemented: (1) MAX_RANGES=100 limit in HttpRange.parseRanges() rejects headers with >100 ranges, and (2) sum validation in HttpRange.toResourceRegions() rejects overlapping ranges where total bytes >= resource length. These protections are active in all resource serving paths including ResourceHttpRequestHandler (webmvc) and ResourceHttpMessageWriter (webflux).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.2.3 is not affected by CVE-2018-15756. The vulnerability (DoS via malicious HTTP Range headers with excessive or overlapping ranges) was fixed in upstream commit 423aa28ed5 by Rossen Stoyanchev (rstoyanchev@pivotal.io) on Oct 3, 2018. This fix was already present in the upstream 6.2.3 release that TuxCare onboarded. Both required defenses are implemented: (1) MAX_RANGES=100 limit in HttpRange.parseRanges() rejects headers with >100 ranges, and (2) sum validation in HttpRange.toResourceRegions() rejects overlapping ranges where total bytes >= resource length. These protections are active in all resource serving paths including ResourceHttpRequestHandler (webmvc) and ResourceHttpMessageWriter (webflux).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:28:22.513379+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2021-22060 (log injection vulnerability). The upstream fix for sanitizing newlines and control characters in log messages was merged in December 2021 (commit 99c7608f) and shipped in Spring Framework 5.3.14 and all 6.x releases. The target version 6.2.3 contains the complete fix in LogFormatUtils.java and all key logging locations properly use LogFo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2021-22060 (log injection vulnerability). The upstream fix for sanitizing newlines and control characters in log messages was merged in December 2021 (commit 99c7608f) and shipped in Spring Framework 5.3.14 and all 6.x releases. The target version 6.2.3 contains the complete fix in LogFormatUtils.java and all key logging locations properly use LogFo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:24:46.559799+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via malicious user input) is NOT present in Spring Framework 6.2.3. The vulnerability allowed attackers to inject newlines and control characters into log files by providing crafted HTTP request data. The upstream vendor (Spring Framework) fixed this vulnerability in commits 99c7608 and e9083d7 by adding control character sanitization to LogFormatUtils and applying...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via malicious user input) is NOT present in Spring Framework 6.2.3. The vulnerability allowed attackers to inject newlines and control characters into log files by providing crafted HTTP request data. The upstream vendor (Spring Framework) fixed this vulnerability in commits 99c7608 and e9083d7 by adding control character sanitization to LogFormatUtils and applying..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-core. CVE-2024-22233 affects Spring Framework 6.0.15 and 6.1.2 with DoS via malformed forwarded headers and regex-pattern URIs. Target version 6.2.3 contains upstream fixes for both vectors (commits 4afac17e58 and 7c9307e970) that were shipped in the upstream release before TuxCare onboarding. The vulnerable code patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 affects Spring Framework 6.0.15 and 6.1.2 with DoS via malformed forwarded headers and regex-pattern URIs. Target version 6.2.3 contains upstream fixes for both vectors (commits 4afac17e58 and 7c9307e970) that were shipped in the upstream release before TuxCare onboarding. The vulnerable code patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-16T00:27:00.260573+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T14:09:00.089781+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.2.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.2.3-tuxcare.4."
    }
  ]
}