{
  "@id": "urn:uuid:e7685d09-9c09-4539-bf81-cb329b7ad4d2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:16:00.061099+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 allows bypassing security constraints via path parameters (e.g., /admin;jsessionid=xxx). The vulnerability was fixed in Spring Security 3.0.4/2.0.6 via SEC-1584, which introduced HttpFirewall to strip path parameters before URL pattern matching. The target (Spring Security 5.1.6.RELEASE) already contains this fix in the upstream release that TuxCare onboarded. The fix commit (7d97...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 allows bypassing security constraints via path parameters (e.g., /admin;jsessionid=xxx). The vulnerability was fixed in Spring Security 3.0.4/2.0.6 via SEC-1584, which introduced HttpFirewall to strip path parameters before URL pattern matching. The target (Spring Security 5.1.6.RELEASE) already contains this fix in the upstream release that TuxCare onboarded. The fix commit (7d97..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.1.6.RELEASE is not affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed by upstream developers in 2011 (SEC-1750) and 2012 (SEC-1967), well before the 5.1.6.RELEASE version. Both fix commits (5fce0a58bd and 9a9aafaeec) are present in HEAD's ancestry and were part of the upstream release that TuxCare onboarded. The vulnerable pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.1.6.RELEASE is not affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed by upstream developers in 2011 (SEC-1750) and 2012 (SEC-1967), well before the 5.1.6.RELEASE version. Both fix commits (5fce0a58bd and 9a9aafaeec) are present in HEAD's ancestry and were part of the upstream release that TuxCare onboarded. The vulnerable pattern ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.1.6.RELEASE-tuxcare.2. The vulnerability was fixed in upstream Spring Security via commit 824464516c (SEC-1790) by Luke Taylor in 2011, which added FirewalledResponse to validate redirect locations and reject any containing CR/LF characters. This fix was already present in the upstream 5.1.6.RELEASE before Tux...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.1.6.RELEASE-tuxcare.2. The vulnerability was fixed in upstream Spring Security via commit 824464516c (SEC-1790) by Luke Taylor in 2011, which added FirewalledResponse to validate redirect locations and reject any containing CR/LF characters. This fix was already present in the upstream 5.1.6.RELEASE before Tux..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 affects Spring Security versions 2.0.0-2.0.6 and 3.0.0-3.0.5 due to unsafe deserialization of entire SecurityContext objects in RMI remote invocations. The target (Spring Security 5.1.6.RELEASE-tuxcare.2) is NOT AFFECTED because the vulnerable pattern is not present. The upstream vendor fix (SEC-1741, commit b48fc53fa2 by Luke Taylor from SpringSource) was already included in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security versions 2.0.0-2.0.6 and 3.0.0-3.0.5 due to unsafe deserialization of entire SecurityContext objects in RMI remote invocations. The target (Spring Security 5.1.6.RELEASE-tuxcare.2) is NOT AFFECTED because the vulnerable pattern is not present. The upstream vendor fix (SEC-1741, commit b48fc53fa2 by Luke Taylor from SpringSource) was already included in the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.1.6.RELEASE. The fix was applied by upstream Spring Security in 2012 (commit c076f0f2e1 by Rob Winch) and was already included in the 5.1.6.RELEASE version when TuxCare onboarded it in 2026. The target code contains comprehensive timing attack mitigation via the mitigateAgainstTimingAttack() method, which performs pas...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.1.6.RELEASE. The fix was applied by upstream Spring Security in 2012 (commit c076f0f2e1 by Rob Winch) and was already included in the 5.1.6.RELEASE version when TuxCare onboarded it in 2026. The target code contains comprehensive timing attack mitigation via the mitigateAgainstTimingAttack() method, which performs pas..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2014-3527 affects Spring Security versions prior to 3.1.7 and 3.2.5 (released 2014). The target is Spring Security 5.1.6.RELEASE (released 2019), which already contains the upstream fix (commit 934937d9c1) that prevents CAS proxy ticket authentication from using untrusted HTTP Host headers. The fix was present in the upstream release before TuxCare onboarding, so the target was never vulnerable at this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 affects Spring Security versions prior to 3.1.7 and 3.2.5 (released 2014). The target is Spring Security 5.1.6.RELEASE (released 2019), which already contains the upstream fix (commit 934937d9c1) that prevents CAS proxy ticket authentication from using untrusted HTTP Host headers. The fix was present in the upstream release before TuxCare onboarding, so the target was never vulnerable at this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. The target Spring Security 5.1.6.RELEASE is not affected by CVE-2016-5007. The vulnerability concerning URL pattern matching discrepancies between Spring Security and Spring MVC was fixed upstream before this version was released. Both key fixes are present: (1) MvcRequestMatcher class that aligns security URL matching with Spring MVC's matching logic, and (2) DefaultHttpFirewall blocking of URL-encoded slashes. These fixes were authored by the upstream Spring Security team (Rob Winch, rwinch@gopivotal.com) and were included in the 5.1.6.RELEASE that TuxCare onboarded, not added as TuxCare backports.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target Spring Security 5.1.6.RELEASE is not affected by CVE-2016-5007. The vulnerability concerning URL pattern matching discrepancies between Spring Security and Spring MVC was fixed upstream before this version was released. Both key fixes are present: (1) MvcRequestMatcher class that aligns security URL matching with Spring MVC's matching logic, and (2) DefaultHttpFirewall blocking of URL-encoded slashes. These fixes were authored by the upstream Spring Security team (Rob Winch, rwinch@gopivotal.com) and were included in the 5.1.6.RELEASE that TuxCare onboarded, not added as TuxCare backports.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. The target Spring Security 5.1.6.RELEASE repository is not affected by CVE-2016-9879. The vulnerability allowed attackers to bypass security constraints by adding URL-encoded forward slashes (%2f or %2F) to request URIs, exploiting inconsistent servlet container handling of path parameters. The fix (detecting and rejecting URL-encoded slashes in DefaultHttpFirewall) was already present in the upstream Spring Security 5.1.6.RELEASE when TuxCare onboarded this version. The fix was authored by upstream maintainer Rob Winch (rwinch@gopivotal.com) in commit 666e356ebc479194ba51e43bb99fc42f849b6175, predating TuxCare's onboarding commit. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target Spring Security 5.1.6.RELEASE repository is not affected by CVE-2016-9879. The vulnerability allowed attackers to bypass security constraints by adding URL-encoded forward slashes (%2f or %2F) to request URIs, exploiting inconsistent servlet container handling of path parameters. The fix (detecting and rejecting URL-encoded slashes in DefaultHttpFirewall) was already present in the upstream Spring Security 5.1.6.RELEASE when TuxCare onboarded this version. The fix was authored by upstream maintainer Rob Winch (rwinch@gopivotal.com) in commit 666e356ebc479194ba51e43bb99fc42f849b6175, predating TuxCare's onboarding commit. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. The target Spring Security 5.1.6.RELEASE is not affected by CVE-2017-4995. The vulnerability concerns unsafe Jackson deserialization with default typing enabled, allowing arbitrary code execution via malicious class names in JSON. The upstream fix (commit 5dee8534cd, May 31 2017, authored by Rob Winch) replaced unrestricted class deserialization with a whitelist-based TypeIdResolver that rejects non-whitelisted classes. This fix was already present in Spring Security 5.1.6.RELEASE when TuxCare onboarded it (commit 080133f7). The vulnerable pattern is not present in the target - the code implements the complete whitelisting defense at SecurityJackson2Modules.java lines 84, 139-244.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "The target Spring Security 5.1.6.RELEASE is not affected by CVE-2017-4995. The vulnerability concerns unsafe Jackson deserialization with default typing enabled, allowing arbitrary code execution via malicious class names in JSON. The upstream fix (commit 5dee8534cd, May 31 2017, authored by Rob Winch) replaced unrestricted class deserialization with a whitelist-based TypeIdResolver that rejects non-whitelisted classes. This fix was already present in Spring Security 5.1.6.RELEASE when TuxCare onboarded it (commit 080133f7). The vulnerable pattern is not present in the target - the code implements the complete whitelisting defense at SecurityJackson2Modules.java lines 84, 139-244.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2018-1199. The vulnerability allowed attackers to bypass security constraints using URL path parameters with semicolons (e.g., /secured/admin.html;x=user.html). The fix, which introduced StrictHttpFirewall to reject requests containing semicolons and other malicious patterns, was already present in the upstream Spring Sec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2018-1199. The vulnerability allowed attackers to bypass security constraints using URL path parameters with semicolons (e.g., /secured/admin.html;x=user.html). The fix, which introduced StrictHttpFirewall to reject requests containing semicolons and other malicious patterns, was already present in the upstream Spring Sec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target version 5.1.6.RELEASE-tuxcare.2 is after 5.1.2 and contains the upstream fix. The vulnerability involved URL.equals() performing DNS resolution, allowing different issuer URLs resolving to the same IP to be considered equivalent. The fix changed issuer validation from URL object comparison to String comparison. Both JwtIssuerValidator.java and MappedJwtClaimSetConverter.java show the fixed code: issuer is stored as String (not URL) and compared using String.equals(). The fix was authored by upstream Spring Security maintainer Josh Cummings and was already present in the upstream 5.1.6.RELEASE when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target version 5.1.6.RELEASE-tuxcare.2 is after 5.1.2 and contains the upstream fix. The vulnerability involved URL.equals() performing DNS resolution, allowing different issuer URLs resolving to the same IP to be considered equivalent. The fix changed issuer validation from URL object comparison to String comparison. Both JwtIssuerValidator.java and MappedJwtClaimSetConverter.java show the fixed code: issuer is stored as String (not URL) and compared using String.equals(). The fix was authored by upstream Spring Security maintainer Josh Cummings and was already present in the upstream 5.1.6.RELEASE when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 5.1.6.RELEASE is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder does not exist in this version - it was removed as part of the Spring Security 5.0 architectural changes that replaced the deprecated org.springframework.security.authentication.encoding package with org.springframework.security.crypto.password. The CVE explicitly affects versions 4.2.x up to 4.2.12 and older; version 5.1.6.RELEASE is outside the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.1.6.RELEASE is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder does not exist in this version - it was removed as part of the Spring Security 5.0 architectural changes that replaced the deprecated org.springframework.security.authentication.encoding package with org.springframework.security.crypto.password. The CVE explicitly affects versions 4.2.x up to 4.2.12 and older; version 5.1.6.RELEASE is outside the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.1.6.RELEASE is not affected by CVE-2019-3795. The vulnerability affects versions 5.1.x prior to 5.1.5, and the fix was already present in the upstream 5.1.6.RELEASE release that TuxCare onboarded. The vulnerable pattern (calling setSeed before nextBytes) is not present in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.1.6.RELEASE is not affected by CVE-2019-3795. The vulnerability affects versions 5.1.x prior to 5.1.5, and the fix was already present in the upstream 5.1.6.RELEASE release that TuxCare onboarded. The vulnerable pattern (calling setSeed before nextBytes) is not present in the target code."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "action_statement": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 describes an integer overflow in BCrypt when using work factor 31, causing 0 salt rounds. The target (Spring Security 5.1.6.RELEASE-tuxcare.2) is NOT affected because the fix was already present in the upstream 5.1.6.RELEASE release when TuxCare onboarded it. The fix (commit 14a5135ac3, July 2012) uses long arithmetic (`1L << log_rounds`) instead of int arithmetic to prevent over...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 describes an integer overflow in BCrypt when using work factor 31, causing 0 salt rounds. The target (Spring Security 5.1.6.RELEASE-tuxcare.2) is NOT affected because the fix was already present in the upstream 5.1.6.RELEASE release when TuxCare onboarded it. The fix (commit 14a5135ac3, July 2012) uses long arithmetic (`1L << log_rounds`) instead of int arithmetic to prevent over..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.6.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.6.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout cleanup saves an empty security context and removes the stored authentication, including with serialized sessions. The persistence filter saves the context in its finally block at web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:108. Saving an empty context removes the session attribute when the original authentication was non-null at web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:343.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout cleanup saves an empty security context and removes the stored authentication, including with serialized sessions. The persistence filter saves the context in its finally block at web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:108. Saving an empty context removes the session attribute when the original authentication was non-null at web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:343."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:45.893536+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation which was introduced in Spring Security 6.2.5 (March 2024) and had a bug in versions 6.3.0 and 6.3.1. Version 5.1.6 predates this feature by approximately 5 years and does not contain the annotation, its interceptor (AuthorizeReturnObjectMethodInterceptor),...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation which was introduced in Spring Security 6.2.5 (March 2024) and had a bug in versions 6.3.0 and 6.3.1. Version 5.1.6 predates this feature by approximately 5 years and does not contain the annotation, its interceptor (AuthorizeReturnObjectMethodInterceptor),..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T00:11:21.706700+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,..."
    }
  ]
}