{
  "@id": "urn:uuid:da140ae1-bc27-4bad-aa0d-b751a32f4b35",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:16:00.061099+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T20:51:00.153763+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2010-3700. The vulnerability allowed bypassing security constraints via path parameters (semicolons in URLs). The fix was introduced in commit 7d97adc687 by upstream developer Luke Taylor in October 2010, shipping RequestWrapper to strip semicolons and HttpFirewall infrastructure. This fix is an ancestor of the first TuxCare commit (onboarding of 5.5...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2010-3700. The vulnerability allowed bypassing security constraints via path parameters (semicolons in URLs). The fix was introduced in commit 7d97adc687 by upstream developer Luke Taylor in October 2010, shipping RequestWrapper to strip semicolons and HttpFirewall infrastructure. This fix is an ancestor of the first TuxCare commit (onboarding of 5.5..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:21:00.085443+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 5.5.8 is NOT affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager allowing cross-thread authentication leakage) was fixed by upstream Spring Security in commits 5fce0a58bd (SEC-1750, Jul 2011) and 9a9aafaeec (SEC-1967, Jul 2012), both authored by luke.taylor@springsource.com. These fixes shipped in the upstream 5.5.8 release that TuxCare onboarded ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 5.5.8 is NOT affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager allowing cross-thread authentication leakage) was fixed by upstream Spring Security in commits 5fce0a58bd (SEC-1750, Jul 2011) and 9a9aafaeec (SEC-1967, Jul 2012), both authored by luke.taylor@springsource.com. These fixes shipped in the upstream 5.5.8 release that TuxCare onboarded ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:59:00.114476+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target (Spring Security 5.5.8-tuxcare.2) is NOT AFFECTED because the upstream vendor fix is already present in the codebase. The fix was authored by Luke Taylor (SpringSource) in commit 824464516c and shipped with the upstream Spring Security 5.5.8 release that TuxCare onboarded. The CRLF validation in Firew...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target (Spring Security 5.5.8-tuxcare.2) is NOT AFFECTED because the upstream vendor fix is already present in the codebase. The fix was authored by Luke Taylor (SpringSource) in commit 824464516c and shipped with the upstream Spring Security 5.5.8 release that TuxCare onboarded. The CRLF validation in Firew..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:37:14.366963+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 is not present in Spring Security 5.5.8. The vulnerability involved deserializing entire SecurityContext objects in ContextPropagatingRemoteInvocation, enabling arbitrary code execution through Java deserialization gadgets. The upstream Spring Security project fixed this in commit b48fc53fa2 (SEC-1741) on May 20, 2011 by Luke Taylor, replacing SecurityContext serialization with st...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is not present in Spring Security 5.5.8. The vulnerability involved deserializing entire SecurityContext objects in ContextPropagatingRemoteInvocation, enabling arbitrary code execution through Java deserialization gadgets. The upstream Spring Security project fixed this in commit b48fc53fa2 (SEC-1741) on May 20, 2011 by Luke Taylor, replacing SecurityContext serialization with st..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:10:21.701598+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 5.5.8. The vulnerability (timing attack allowing username enumeration via differential response times) was fixed by upstream Spring Security in commit c076f0f2e1 (SEC-2056) authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream Spring Security 5.5.8 release that TuxCare onboarded. The target code contains the compl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 5.5.8. The vulnerability (timing attack allowing username enumeration via differential response times) was fixed by upstream Spring Security in commit c076f0f2e1 (SEC-2056) authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream Spring Security 5.5.8 release that TuxCare onboarded. The target code contains the compl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:59:55.924062+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. The target Spring Security 5.5.8 repository is not affected by CVE-2014-3527. The vulnerability pattern (using untrusted HTTP request headers for CAS service URL construction) is not present in the target code. The upstream fix (commit 934937d9c1) authored by Rob Winch from Pivotal was already included in Spring Security 5.5.8 release that TuxCare onboarded. The fixed code uses the pre-configured trusted service URL from ServiceProperties instead of untrusted request headers, preventing attackers from bypassing CAS access control restrictions.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target Spring Security 5.5.8 repository is not affected by CVE-2014-3527. The vulnerability pattern (using untrusted HTTP request headers for CAS service URL construction) is not present in the target code. The upstream fix (commit 934937d9c1) authored by Rob Winch from Pivotal was already included in Spring Security 5.5.8 release that TuxCare onboarded. The fixed code uses the pre-configured trusted service URL from ServiceProperties instead of untrusted request headers, preventing attackers from bypassing CAS access control restrictions."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. Spring Security 5.5.8 is not affected by CVE-2016-5007. Both upstream fixes are present: (1) MvcRequestMatcher for aligning Security/MVC path matching, and (2) encoded slash blocking in DefaultHttpFirewall. Additionally, StrictHttpFirewall (the default since 4.2.4) provides runtime protection by rejecting encoded slashes. Both fixes were authored by upstream (rwinch@gopivotal.com) and shipped in Spring Security 5.5.8 before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 5.5.8 is not affected by CVE-2016-5007. Both upstream fixes are present: (1) MvcRequestMatcher for aligning Security/MVC path matching, and (2) encoded slash blocking in DefaultHttpFirewall. Additionally, StrictHttpFirewall (the default since 4.2.4) provides runtime protection by rejecting encoded slashes. Both fixes were authored by upstream (rwinch@gopivotal.com) and shipped in Spring Security 5.5.8 before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:01.158878+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. The target Spring Security 5.5.8 is NOT affected by CVE-2016-9879. The vulnerability (bypassing security constraints via URL-encoded slash in path parameters) was fixed by upstream Spring Security maintainers in commit 666e356ebc before the 5.5.8 release. The fix adds validation in DefaultHttpFirewall.getFirewalledRequest() that rejects requests containing \"%2f\" or \"%2F\" in the requestURI by throwing RequestRejectedException. This defense code is present and active (by default) in the target version at web/src/main/java/org/springframework/security/web/firewall/DefaultHttpFirewall.java lines 59-62 and 86-94. TuxCare onboarded version 5.5.8 which already contained this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target Spring Security 5.5.8 is NOT affected by CVE-2016-9879. The vulnerability (bypassing security constraints via URL-encoded slash in path parameters) was fixed by upstream Spring Security maintainers in commit 666e356ebc before the 5.5.8 release. The fix adds validation in DefaultHttpFirewall.getFirewalledRequest() that rejects requests containing \"%2f\" or \"%2F\" in the requestURI by throwing RequestRejectedException. This defense code is present and active (by default) in the target version at web/src/main/java/org/springframework/security/web/firewall/DefaultHttpFirewall.java lines 59-62 and 86-94. TuxCare onboarded version 5.5.8 which already contained this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2017-4995 deserialization vulnerability is not present in Spring Security 5.5.8. The upstream fix (commit 5dee8534cd by Rob Winch, May 2017) replaced unrestricted Jackson default typing with an allowlist-based TypeIdResolver that validates all deserialized classes. This fix was already part of Spring Security 5.5.8 when TuxCare onboarded it in May 2022, 5 years after the original fix. The target contains AllowlistTypeIdResolver which is semantically identical to the patch's WhitelistTypeIdResolver (cosmetic renaming for inclusive language).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "CVE-2017-4995 deserialization vulnerability is not present in Spring Security 5.5.8. The upstream fix (commit 5dee8534cd by Rob Winch, May 2017) replaced unrestricted Jackson default typing with an allowlist-based TypeIdResolver that validates all deserialized classes. This fix was already part of Spring Security 5.5.8 when TuxCare onboarded it in May 2022, 5 years after the original fix. The target contains AllowlistTypeIdResolver which is semantically identical to the patch's WhitelistTypeIdResolver (cosmetic renaming for inclusive language).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:42:56.211039+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.8 is NOT vulnerable to CVE-2018-1199. The fix (StrictHttpFirewall) was introduced in upstream commit 0eef5b4b42 by Rob Winch and was already included in the 5.5.8 release. StrictHttpFirewall is the default firewall that rejects URLs containing semicolons, encoded slashes, encoded periods, and unnormalized paths - preventing the path parameter bypass attack described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is NOT vulnerable to CVE-2018-1199. The fix (StrictHttpFirewall) was introduced in upstream commit 0eef5b4b42 by Rob Winch and was already included in the 5.5.8 release. StrictHttpFirewall is the default firewall that rejects URLs containing semicolons, encoded slashes, encoded periods, and unnormalized paths - preventing the path parameter bypass attack described in the CVE."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. Spring Security 5.5.8 is not affected by CVE-2018-15801. The vulnerability required URL object comparison for JWT issuer validation, which allowed different issuer URLs to be treated as equivalent due to URL.equals() semantics (DNS resolution, port normalization). The target code uses string comparison instead: MappedJwtClaimSetConverter converts issuer claims to String via URL.toExternalForm(), and JwtIssuerValidator compares using issuer.equals(claimValue.toString()). This fix was authored by josh.cummings@gmail.com in commit 19649db9ce (2018-11-13) and was already present in upstream Spring Security 5.5.8 when TuxCare onboarded it in commit 8cf3277976.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "Spring Security 5.5.8 is not affected by CVE-2018-15801. The vulnerability required URL object comparison for JWT issuer validation, which allowed different issuer URLs to be treated as equivalent due to URL.equals() semantics (DNS resolution, port normalization). The target code uses string comparison instead: MappedJwtClaimSetConverter converts issuer claims to String via URL.toExternalForm(), and JwtIssuerValidator compares using issuer.equals(claimValue.toString()). This fix was authored by josh.cummings@gmail.com in commit 19649db9ce (2018-11-13) and was already present in upstream Spring Security 5.5.8 when TuxCare onboarded it in commit 8cf3277976.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security versions 4.2.x up to 4.2.12 and older. The target repository (Spring Security 5.5.8) does not contain the vulnerable PlaintextPasswordEncoder class. This class was removed from Spring Security in version 5.0.0.RC1 (October 2017) by upstream maintainer Rob Winch, prior to the 5.5.8 release. The vulnerability allowed authentication bypass when a user had a null encoded password by matching the string \"null\", but since the vulnerable code does not exist in version 5.5.8, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security versions 4.2.x up to 4.2.12 and older. The target repository (Spring Security 5.5.8) does not contain the vulnerable PlaintextPasswordEncoder class. This class was removed from Spring Security in version 5.0.0.RC1 (October 2017) by upstream maintainer Rob Winch, prior to the 5.5.8 release. The vulnerability allowed authentication bypass when a user had a null encoded password by matching the string \"null\", but since the vulnerable code does not exist in version 5.5.8, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:54:12.578535+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.5.8-tuxcare.2 is NOT affected by CVE-2019-3795. The vulnerability was fixed in upstream Spring Security 5.1.5 (March 2019), and version 5.5.8 already contained the fix when TuxCare onboarded it. The fix ensures nextBytes() is called BEFORE setSeed() to prevent user-provided seeds from replacing the entire SecureRandom state, thereby maintaining cryptographic strengt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.5.8-tuxcare.2 is NOT affected by CVE-2019-3795. The vulnerability was fixed in upstream Spring Security 5.1.5 (March 2019), and version 5.5.8 already contained the fix when TuxCare onboarded it. The fix ensures nextBytes() is called BEFORE setSeed() to prevent user-provided seeds from replacing the entire SecureRandom state, thereby maintaining cryptographic strengt..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:38:00.054920+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.8 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.8 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T16:47:27.426165+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Target is Spring Security 5.5.8 (official upstream release), newer than every CVE-2020-5408 affected range (fix landed in 5.3.2/5.2.4/5.1.10/5.0.16/4.2.16). CVE-2020-5408: Encryptors.queryableText() uses a fixed all-zero (null) IV with AES-CBC, producing deterministic ciphertext that lets an attacker with read access to stored ciphertext derive plaintext via dictionary/frequency attacks. The vendor's fix (the exact input patch, commit db155b3094 \"Clean up Javadoc\") did NOT add a random IV \u2014 doing so would break the deterministic-query feature \u2014 it instead DEPRECATED the queryableText() method with the note \"This encryptor is not secure. Instead, look to your data store for a mechanism to query encrypted data.\" That deprecation is present in the target: Encryptors.java lines 103-107 carry @deprecated + @Deprecated on queryableText(), and commit db155b3094 is confirmed an ancestor of HEAD. Per Rule 3 (trust vendor fix intent), deprecation is the authoritative fix and must not be deemed \"insufficient.\" The fix commit is authored by Eleftheria Stein <eleftheria.kousathana@gmail.com> (upstream Spring, not TuxCare/CloudLinux), and HEAD (5.5.8) is an upstream release by sriesenberg@vmware.com \u2014 so this is the UPSTREAM-fix sub-case of not_affected (justification code_not_present), not already_fixed. Patch 2 (d1909ec, BCryptPasswordEncoder null-check) is unrelated to this CVE. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 Target is Spring Security 5.5.8 (official upstream release), newer than every CVE-2020-5408 affected range (fix landed in 5.3.2/5.2.4/5.1.10/5.0.16/4.2.16). CVE-2020-5408: Encryptors.queryableText() uses a fixed all-zero (null) IV with AES-CBC, producing deterministic ciphertext that lets an attacker with read access to stored ciphertext derive plaintext via dictionary/frequency attacks. The vendor's fix (the exact input patch, commit db155b3094 \"Clean up Javadoc\") did NOT add a random IV \u2014 doing so would break the deterministic-query feature \u2014 it instead DEPRECATED the queryableText() method with the note \"This encryptor is not secure. Instead, look to your data store for a mechanism to query encrypted data.\" That deprecation is present in the target: Encryptors.java lines 103-107 carry @deprecated + @Deprecated on queryableText(), and commit db155b3094 is confirmed an ancestor of HEAD. Per Rule 3 (trust vendor fix intent), deprecation is the authoritative fix and must not be deemed \"insufficient.\" The fix commit is authored by Eleftheria Stein <eleftheria.kousathana@gmail.com> (upstream Spring, not TuxCare/CloudLinux), and HEAD (5.5.8) is an upstream release by sriesenberg@vmware.com \u2014 so this is the UPSTREAM-fix sub-case of not_affected (justification code_not_present), not already_fixed. Patch 2 (d1909ec, BCryptPasswordEncoder null-check) is unrelated to this CVE. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2021-22119 affects Spring Security 5.5.x prior to 5.5.1. The target is version 5.5.8-tuxcare.2, which contains the upstream fix from commit 35f5ebdbcf. The fix changes HttpSessionOAuth2AuthorizationRequestRepository to store only one authorization request per session by default (preventing DoS through unbounded Map accumulation). The fix was shipped in upstream Spring Security 5.5.0/5.5.1 and was already present when TuxCare onboarded version 5.5.8. The vulnerable pattern (unconditional Map storage allowing unlimited authorization requests per session) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 affects Spring Security 5.5.x prior to 5.5.1. The target is version 5.5.8-tuxcare.2, which contains the upstream fix from commit 35f5ebdbcf. The fix changes HttpSessionOAuth2AuthorizationRequestRepository to store only one authorization request per session by default (preventing DoS through unbounded Map accumulation). The fix was shipped in upstream Spring Security 5.5.0/5.5.1 and was already present when TuxCare onboarded version 5.5.8. The vulnerable pattern (unconditional Map storage allowing unlimited authorization requests per session) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:09:50.143748+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2022-22976. The vulnerability (integer overflow in BCrypt when using work factor 31, causing zero salt rounds) was fixed in upstream Spring Security 5.5.7, and the fix was already present in the 5.5.8 release that TuxCare onboarded. The vulnerable code pattern `int rounds = 1 << log_rounds` has been replaced with `long rounds = roundsForLogRounds(log...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2022-22976. The vulnerability (integer overflow in BCrypt when using work factor 31, causing zero salt rounds) was fixed in upstream Spring Security 5.5.7, and the fix was already present in the 5.5.8 release that TuxCare onboarded. The vulnerable code pattern `int rounds = 1 << log_rounds` has been replaced with `long rounds = roundsForLogRounds(log..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2022-22978 affects Spring Security versions 5.5.6, 5.5.7, and older versions where RegexRequestMatcher with `.` in regex patterns could be bypassed using line terminators (\\n, \\r). The target version 5.5.8 is NOT affected because the upstream fix (commit c6461d61babfcf92febfd0a85785623e53190a8f) was already included in the upstream Spring Security 5.5.8 release before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0) is not present; the code correctly uses Pattern.DOTALL to ensure `.` matches line terminators in authorization regex patterns.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 affects Spring Security versions 5.5.6, 5.5.7, and older versions where RegexRequestMatcher with `.` in regex patterns could be bypassed using line terminators (\\n, \\r). The target version 5.5.8 is NOT affected because the upstream fix (commit c6461d61babfcf92febfd0a85785623e53190a8f) was already included in the upstream Spring Security 5.5.8 release before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0) is not present; the code correctly uses Pattern.DOTALL to ensure `.` matches line terminators in authorization regex patterns.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it cannot enable the all-dispatcher authorization mode required by this vulnerability. In web/src/main/java/org/springframework/security/web/access/intercept/AuthorizationFilter.java:40, AuthorizationFilter extends OncePerRequestFilter and has no dispatcher configuration setter. The configuration registry exposes no all-dispatcher option in config/src/main/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java:89.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it cannot enable the all-dispatcher authorization mode required by this vulnerability. In web/src/main/java/org/springframework/security/web/access/intercept/AuthorizationFilter.java:40, AuthorizationFilter extends OncePerRequestFilter and has no dispatcher configuration setter. The configuration registry exposes no all-dispatcher option in config/src/main/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java:89."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version\u2019s configurer installs `SecurityContextPersistenceFilter`, ordered before `LogoutFilter` (SecurityContextConfigurer.java:84, FilterOrderRegistration.java:73). Logout lacks the upstream explicit save, but clears authentication and the context holder even when session invalidation is disabled (SecurityContextLogoutHandler.java:60). Repository loading installs a response wrapper that captures the authenticated context\u2019s original authentication (HttpSessionSecurityContextRepository.java:115, same file:307). After logout, retrieving the cleared holder produces an empty context, which the persistence filter saves in its `finally` block using that wrapped response (ThreadLocalSecurityContextHolderStrategy.java:34, SecurityContextPersistenceFilter.java:112).",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version\u2019s configurer installs `SecurityContextPersistenceFilter`, ordered before `LogoutFilter` (SecurityContextConfigurer.java:84, FilterOrderRegistration.java:73). Logout lacks the upstream explicit save, but clears authentication and the context holder even when session invalidation is disabled (SecurityContextLogoutHandler.java:60). Repository loading installs a response wrapper that captures the authenticated context\u2019s original authentication (HttpSessionSecurityContextRepository.java:115, same file:307). After logout, retrieving the cleared holder produces an empty context, which the persistence filter saves in its `finally` block using that wrapped response (ThreadLocalSecurityContextHolderStrategy.java:34, SecurityContextPersistenceFilter.java:112)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:00:50.903105+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation introduced in Spring Security 6.3.0, which does not exist in version 5.5.8. The target version predates this feature by multiple major releases. Exhaustive code search confirms the annotation, its processing infrastructure, and the vulnerable pattern are absent from the code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation introduced in Spring Security 6.3.0, which does not exist in version 5.5.8. The target version predates this feature by multiple major releases. Exhaustive code search confirms the annotation, its processing infrastructure, and the vulnerable pattern are absent from the code..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:23:11.597840+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2025-22223. This vulnerability specifically affects Spring Security 6.0+ systems using @EnableMethodSecurity, where the UniqueSecurityAnnotationScanner class fails to resolve generic type parameters correctly. Version 5.5.8 does not have @EnableMethodSecurity or UniqueSecurityAnnotationScanner\u2014it uses the older @EnableGlobalMethodSecurity infrastruct...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2025-22223. This vulnerability specifically affects Spring Security 6.0+ systems using @EnableMethodSecurity, where the UniqueSecurityAnnotationScanner class fails to resolve generic type parameters correctly. Version 5.5.8 does not have @EnableMethodSecurity or UniqueSecurityAnnotationScanner\u2014it uses the older @EnableGlobalMethodSecurity infrastruct..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T16:47:27.426165+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.8 (released May 2022) does NOT contain CVE-2025-22234. This CVE is a regression bug introduced by patch 1 (commit c1aa99fdd2, April 2025) which added conditional 72-byte password length enforcement to BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target repository lacks this conditional check entirely\u2014BCrypt.java contains no passw...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 (released May 2022) does NOT contain CVE-2025-22234. This CVE is a regression bug introduced by patch 1 (commit c1aa99fdd2, April 2025) which added conditional 72-byte password length enforcement to BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target repository lacks this conditional check entirely\u2014BCrypt.java contains no passw..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:47:12.586674+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.5.8 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.5.8 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T11:36:00.176663+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.5.8 predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.5.8 predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.8-tuxcare.2 does not contain the vulnerable JdbcOneTimeTokenService class or the One-Time Token (OTT) authentication feature. The OTT feature was introduced in later versions (6.5.x+) and does not exist in version 5.5.8. Exhaustive searches confirmed no OTT-related code, classes, or packages are present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8-tuxcare.2 does not contain the vulnerable JdbcOneTimeTokenService class or the One-Time Token (OTT) authentication feature. The OTT feature was introduced in later versions (6.5.x+) and does not exist in version 5.5.8. Exhaustive searches confirmed no OTT-related code, classes, or packages are present in the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:54:00.174826+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.5.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.5.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() methods does not exist in this version. This class was introduced in Spring Security 7.1.x, multiple major versions after 5.5.8. The target version only contains IpAddressMatcher, which matches specific IP addresses or CIDR ranges but does not perform internal/e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() methods does not exist in this version. This class was introduced in Spring Security 7.1.x, multiple major versions after 5.5.8. The target version only contains IpAddressMatcher, which matches specific IP addresses or CIDR ranges but does not perform internal/e..."
    }
  ]
}