{
  "@id": "urn:uuid:bd12ae81-2a9b-4c6c-b243-70846ec7e8b7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:40:50.837478+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:55:43.536651+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.7 is NOT affected by CVE-2009-1190. The vulnerability was an algorithmic complexity attack via deserialization of malicious regex patterns. The upstream fix (commit 9306d6db, April 2009) removed the vulnerable deserialization pattern by eliminating the readObject() method that re-compiled regex patterns during deserialization. The fix changed the serialization mechanism to ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.7 is NOT affected by CVE-2009-1190. The vulnerability was an algorithmic complexity attack via deserialization of malicious regex patterns. The upstream fix (commit 9306d6db, April 2009) removed the vulnerable deserialization pattern by eliminating the readObject() method that re-compiled regex patterns during deserialization. The fix changed the serialization mechanism to ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:50.837478+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T09:55:00.073520+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 targeted Spring Framework 3.0.0-3.0.5's remoting subsystem (RMI exporters) which allowed untrusted proxy class deserialization. Spring Framework 6.2.7 is not affected: (1) the entire remoting package (org.springframework.remoting) has been removed, eliminating the vulnerable entry points (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream); (2) the core fix (accep...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 targeted Spring Framework 3.0.0-3.0.5's remoting subsystem (RMI exporters) which allowed untrusted proxy class deserialization. Spring Framework 6.2.7 is not affected: (1) the entire remoting package (org.springframework.remoting) has been removed, eliminating the vulnerable entry points (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream); (2) the core fix (accep..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 (directory traversal via crafted URL with colon characters) is NOT present in Spring Framework 6.2.7-tuxcare.3. The vulnerability was fixed in upstream versions 3.2.9 and 4.0.5 (released May 2014). The fix is present in the target at commit 8ee465103850a3dca018273fe5952e40d5c45a66, authored by rstoyanchev@gopivotal.com, which was included in the upstream 6.2.7 release before TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 (directory traversal via crafted URL with colon characters) is NOT present in Spring Framework 6.2.7-tuxcare.3. The vulnerability was fixed in upstream versions 3.2.9 and 4.0.5 (released May 2014). The fix is present in the target at commit 8ee465103850a3dca018273fe5952e40d5c45a66, authored by rstoyanchev@gopivotal.com, which was included in the upstream 6.2.7 release before TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T19:20:43.319935+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client used AlternativeJdkIdGenerator for session IDs, which employed java.util.Random (predictable) after initial seeding. The target version 6.2.7-tuxcare.3 contains the upstream fix (commit 52b8f34468 by Rossen Stoyanchev) that switched to JdkIdGenerator, which uses UUID.randomUUID() with SecureRandom internally. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client used AlternativeJdkIdGenerator for session IDs, which employed java.util.Random (predictable) after initial seeding. The target version 6.2.7-tuxcare.3 contains the upstream fix (commit 52b8f34468 by Rossen Stoyanchev) that switched to JdkIdGenerator, which uses UUID.randomUUID() with SecureRandom internally. The ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.2.7-tuxcare.2. The upstream vendor (Pivotal/VMware Spring team) shipped the complete fix in the original 6.2.7 release, which TuxCare onboarded. The fix commit 2bd1daa75e \"Protect against RFD exploits\" by rstoyanchev@pivotal.io is present on HEAD and predates the first TuxCare commit (3c5280fed6 \"Onboard version 6.2.7\"). The defense adds Content-Disposition headers with safe filenames when responses contain unsafe file extensions (.bat, .cmd, .exe, etc.), preventing browsers from interpreting response content as executable files. The vulnerable pattern is not present because the upstream fix was already included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.2.7-tuxcare.2. The upstream vendor (Pivotal/VMware Spring team) shipped the complete fix in the original 6.2.7 release, which TuxCare onboarded. The fix commit 2bd1daa75e \"Protect against RFD exploits\" by rstoyanchev@pivotal.io is present on HEAD and predates the first TuxCare commit (3c5280fed6 \"Onboard version 6.2.7\"). The defense adds Content-Disposition headers with safe filenames when responses contain unsafe file extensions (.bat, .cmd, .exe, etc.), preventing browsers from interpreting response content as executable files. The vulnerable pattern is not present because the upstream fix was already included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:18:44.496921+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. CVE-2016-5007 affects Spring Framework versions where differences in URL pattern matching between Spring Security and Spring MVC can lead to authorization bypass. The vulnerability was fixed in upstream Spring Framework 4.3.1+ via commit a30ab30e4e which introduced the HandlerMappingIntrospector API. This fix was already present in the upstream Spring Framework 6.2.7 release that TuxCare onboarded. The target repository at version 6.2.7 contains the complete fix including HandlerMappingIntrospector, MatchableHandlerMapping interface, and RequestMatchResult classes. The fix allows Spring Security to use the exact same pattern matching logic as Spring MVC, eliminating pattern matching discrepancies that could bypass security checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 affects Spring Framework versions where differences in URL pattern matching between Spring Security and Spring MVC can lead to authorization bypass. The vulnerability was fixed in upstream Spring Framework 4.3.1+ via commit a30ab30e4e which introduced the HandlerMappingIntrospector API. This fix was already present in the upstream Spring Framework 6.2.7 release that TuxCare onboarded. The target repository at version 6.2.7 contains the complete fix including HandlerMappingIntrospector, MatchableHandlerMapping interface, and RequestMatchResult classes. The fix allows Spring Security to use the exact same pattern matching logic as Spring MVC, eliminating pattern matching discrepancies that could bypass security checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:13.058306+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, where JSONP support in MappingJackson2JsonView was enabled by default via \"jsonp\" and \"callback\" query parameters, allowing unintended cross-domain requests. The target version 6.2.7 is NOT affected because JSONP support was completely removed by upstream Spring Framework in version 5.1.0 (June 2018, commit ac37b678a3). The vulnerable code (jsonpParameterNames field, setJsonpParameterNames/getJsonpParameterValue/isValidJsonpQueryParam methods, JSONP wrapping logic) is entirely absent from the target. This upstream fix was already present in the 6.2.7 release when TuxCare onboarded it in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, where JSONP support in MappingJackson2JsonView was enabled by default via \"jsonp\" and \"callback\" query parameters, allowing unintended cross-domain requests. The target version 6.2.7 is NOT affected because JSONP support was completely removed by upstream Spring Framework in version 5.1.0 (June 2018, commit ac37b678a3). The vulnerable code (jsonpParameterNames field, setJsonpParameterNames/getJsonpParameterValue/isValidJsonpQueryParam methods, JSONP wrapping logic) is entirely absent from the target. This upstream fix was already present in the 6.2.7 release when TuxCare onboarded it in October 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T01:14:00.204394+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The target version 6.2.7-tuxcare.3 is not affected because the upstream Spring Framework already fixed this vulnerability in March 2018 (commits 0e28bee0, 91b803a2, etc.). The fix \u2014 path normalization via ResourceHandlerUtils.normalizeInputPath() and validation via shouldIgnoreInputPath() \u2014 is present in the upst...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3. The target version 6.2.7-tuxcare.3 is not affected because the upstream Spring Framework already fixed this vulnerability in March 2018 (commits 0e28bee0, 91b803a2, etc.). The fix \u2014 path normalization via ResourceHandlerUtils.normalizeInputPath() and validation via shouldIgnoreInputPath() \u2014 is present in the upst..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:55:43.536651+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.7-tuxcare.2 is not affected by CVE-2018-1257. The vulnerability allowed Regular Expression Denial of Service (ReDoS) attacks via malicious SpEL expressions in STOMP subscription selector headers. The upstream fix (commit 5bc80fc094 by Sam Brannen, June 2023) disables SpEL selector support by default by initializing selectorHeaderName to null instead of \"selector\", preventin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.7-tuxcare.2 is not affected by CVE-2018-1257. The vulnerability allowed Regular Expression Denial of Service (ReDoS) attacks via malicious SpEL expressions in STOMP subscription selector headers. The upstream fix (commit 5bc80fc094 by Sam Brannen, June 2023) disables SpEL selector support by default by initializing selectorHeaderName to null instead of \"selector\", preventin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. Spring Framework 6.2.7 is not affected by CVE-2018-1258. The vulnerability affected version 5.0.5 where AopUtils.getMostSpecificMethod() excluded proxy classes from proper method resolution, allowing annotation-based security controls to be bypassed. The fix was applied by upstream Spring Framework in April 2018 (commit aa11721ff0) and was already present in the 6.2.7 release that TuxCare onboarded. The vulnerable pattern (the `!Proxy.isProxyClass(targetClass)` exclusion in getMostSpecificMethod) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 6.2.7 is not affected by CVE-2018-1258. The vulnerability affected version 5.0.5 where AopUtils.getMostSpecificMethod() excluded proxy classes from proper method resolution, allowing annotation-based security controls to be bypassed. The fix was applied by upstream Spring Framework in April 2018 (commit aa11721ff0) and was already present in the 6.2.7 release that TuxCare onboarded. The vulnerable pattern (the `!Proxy.isProxyClass(targetClass)` exclusion in getMostSpecificMethod) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:55:43.536651+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 6.2.7. The upstream vendor fix (authored in March 2018 for Spring issue SPR-16616) was already included in the 6.2.7 release shipped by Spring. The fix adds validation to reject URL-decoded paths containing both forward-slash (../) and Windows-backslash (..\\) directory traversal sequences, along with path normali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 6.2.7. The upstream vendor fix (authored in March 2018 for Spring issue SPR-16616) was already included in the 6.2.7 release shipped by Spring. The fix adds validation to reject URL-decoded paths containing both forward-slash (../) and Windows-backslash (..\\) directory traversal sequences, along with path normali..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:57.157354+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. Spring Framework 6.2.7 is not affected by CVE-2018-1272. The vulnerability involves predictable multipart boundary generation allowing attackers to inject additional multipart sections when forwarding requests, potentially leading to privilege escalation. The target uses SecureRandom (not predictable Random) for boundary generation via lazy initialization in MimeTypeUtils.initRandom() (line 409). The fix was authored by upstream Spring Framework (rstoyanchev@pivotal.io, commit ab2410c754) and was already present in the 6.2.7 upstream release that TuxCare onboarded (first TuxCare commit: 3c5280fed6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.2.7 is not affected by CVE-2018-1272. The vulnerability involves predictable multipart boundary generation allowing attackers to inject additional multipart sections when forwarding requests, potentially leading to privilege escalation. The target uses SecureRandom (not predictable Random) for boundary generation via lazy initialization in MimeTypeUtils.initRandom() (line 409). The fix was authored by upstream Spring Framework (rstoyanchev@pivotal.io, commit ab2410c754) and was already present in the 6.2.7 upstream release that TuxCare onboarded (first TuxCare commit: 3c5280fed6).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T13:45:46.709129+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. Spring Framework 6.2.7 is not affected by CVE-2018-15756. The vulnerability fix was included in the upstream Spring Framework release before TuxCare onboarded version 6.2.7. The target code contains both required defenses: (1) MAX_RANGES=100 limit to reject Range headers with more than 100 ranges, and (2) validation that the sum of all range lengths does not equal or exceed the resource length when multiple ranges are present. Fix commit 423aa28ed5 by upstream author rstoyanchev@pivotal.io is an ancestor of the TuxCare onboarding commit 3c5280fed6, confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.2.7 is not affected by CVE-2018-15756. The vulnerability fix was included in the upstream Spring Framework release before TuxCare onboarded version 6.2.7. The target code contains both required defenses: (1) MAX_RANGES=100 limit to reject Range headers with more than 100 ranges, and (2) validation that the sum of all range lengths does not equal or exceed the resource length when multiple ranges are present. Fix commit 423aa28ed5 by upstream author rstoyanchev@pivotal.io is an ancestor of the TuxCare onboarding commit 3c5280fed6, confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:55:43.536651+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 log injection vulnerability is NOT present in Spring Framework 6.2.7. The fix (sanitization of newline and control characters in log output via LogFormatUtils) was already included in the upstream Spring Framework 6.2.7 release that TuxCare onboarded. The vulnerable pattern\u2014logging user-controlled input without sanitizing newlines/control characters\u2014is not present in the target c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 log injection vulnerability is NOT present in Spring Framework 6.2.7. The fix (sanitization of newline and control characters in log output via LogFormatUtils) was already included in the upstream Spring Framework 6.2.7 release that TuxCare onboarded. The vulnerable pattern\u2014logging user-controlled input without sanitizing newlines/control characters\u2014is not present in the target c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:55:43.536651+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.7 is not affected by CVE-2021-22096 (log injection via newline/control characters). The vulnerability affects versions 5.3.0-5.3.10, 5.2.0-5.2.17, and older. All upstream fixes for this CVE were already present in Spring Framework 6.2.7 when TuxCare onboarded it. The fix includes: (1) LogFormatUtils replaces newlines with &lt;EOL&gt; and control characters with ? before log...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.7 is not affected by CVE-2021-22096 (log injection via newline/control characters). The vulnerability affects versions 5.3.0-5.3.10, 5.2.0-5.2.17, and older. All upstream fixes for this CVE were already present in Spring Framework 6.2.7 when TuxCare onboarded it. The fix includes: (1) LogFormatUtils replaces newlines with &lt;EOL&gt; and control characters with ? before log..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-core. Target Spring Framework 6.2.7 is NOT affected by CVE-2024-22233. Both vulnerability fixes (ForwardedHeaderFilter exception handling and HandlerMappingIntrospector URI matching) were already included in the upstream Spring Framework 6.2.7 release before TuxCare onboarded it. The fixes were authored by Brian Clozel from Broadcom and shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Target Spring Framework 6.2.7 is NOT affected by CVE-2024-22233. Both vulnerability fixes (ForwardedHeaderFilter exception handling and HandlerMappingIntrospector URI matching) were already included in the upstream Spring Framework 6.2.7 release before TuxCare onboarded it. The fixes were authored by Brian Clozel from Broadcom and shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:55:43.536651+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 6.2.7-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 6.2.7-tuxcare.3 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T12:55:43.536651+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.2.7-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}