{
  "@id": "urn:uuid:74d6953c-d771-47d7-b584-ce23893c17b2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:16:00.061099+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (semicolon-delimited, RFC 2396). The target (Spring Security 5.6.3) is NOT AFFECTED because the fix was already present in the upstream release. The vulnerability allowed paths like `/secured/admin.html;x=user.html` to bypass URL pattern matching. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (semicolon-delimited, RFC 2396). The target (Spring Security 5.6.3) is NOT AFFECTED because the fix was already present in the upstream release. The vulnerability allowed paths like `/secured/admin.html;x=user.html` to bypass URL pattern matching. Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.3-tuxcare.2 is not affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed in upstream commits 5fce0a58bd (SEC-1750, July 2011) and 9a9aafaeec (SEC-1967, July 2012), both authored by Spring Security team members Luke Taylor and Rob Winch. These fixes were already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded in Oct...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.3-tuxcare.2 is not affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed in upstream commits 5fce0a58bd (SEC-1750, July 2011) and 9a9aafaeec (SEC-1967, July 2012), both authored by Spring Security team members Luke Taylor and Rob Winch. These fixes were already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded in Oct..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 5.6.3-tuxcare.2. The vulnerability (CRLF injection in redirect URLs) was fixed by upstream Spring Security in 2011 via SEC-1790. The fix was shipped in the upstream 5.6.3 release that TuxCare onboarded. The FirewalledResponse class validates all redirect locations and rejects any containing CR or LF characters before processing, blocking the attac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 5.6.3-tuxcare.2. The vulnerability (CRLF injection in redirect URLs) was fixed by upstream Spring Security in 2011 via SEC-1790. The fix was shipped in the upstream 5.6.3 release that TuxCare onboarded. The FirewalledResponse class validates all redirect locations and rejects any containing CR or LF characters before processing, blocking the attac..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2011-2894. The vulnerable deserialization pattern was fixed by upstream Spring Security in 2011 (commit b48fc53fa2, SEC-1741) and the fix was already present in the 5.6.3 release onboarded by TuxCare. The current implementation transmits only string representations of principal and credentials instead of serializing the entire SecurityContext object,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2011-2894. The vulnerable deserialization pattern was fixed by upstream Spring Security in 2011 (commit b48fc53fa2, SEC-1741) and the fix was already present in the 5.6.3 release onboarded by TuxCare. The current implementation transmits only string representations of principal and credentials instead of serializing the entire SecurityContext object,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The target is not affected by CVE-2012-5055. The timing attack vulnerability was fixed by the upstream vendor (Spring Security) in commit c076f0f2e1 authored by Rob Winch in September 2012. This fix, which adds password validation even when the user is not found, was already present in the upstream release 5.6.3 that TuxCare onboarded. The vulnerable pattern (skipping password check when user n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 The target is not affected by CVE-2012-5055. The timing attack vulnerability was fixed by the upstream vendor (Spring Security) in commit c076f0f2e1 authored by Rob Winch in September 2012. This fix, which adds password validation even when the user is not found, was already present in the upstream release 5.6.3 that TuxCare onboarded. The vulnerable pattern (skipping password check when user n..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 5.6.3 is not affected by CVE-2014-3527. The vulnerability, which allowed CAS proxy ticket authentication to be manipulated via HTTP Host header injection, was fixed in the upstream codebase in July 2014 (commit 934937d9c1). This fix was already present in the Spring Security 5.6.3 release that TuxCare onboarded. The vulnerable pattern (using request.getScheme(), request.getServerName(), request.getServerPort() for service URL construction) does not exist in the target; instead, the code uses the pre-configured service URL from ServiceProperties, preventing header injection attacks.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "Spring Security 5.6.3 is not affected by CVE-2014-3527. The vulnerability, which allowed CAS proxy ticket authentication to be manipulated via HTTP Host header injection, was fixed in the upstream codebase in July 2014 (commit 934937d9c1). This fix was already present in the Spring Security 5.6.3 release that TuxCare onboarded. The vulnerable pattern (using request.getScheme(), request.getServerName(), request.getServerPort() for service URL construction) does not exist in the target; instead, the code uses the pre-configured service URL from ServiceProperties, preventing header injection attacks."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 5.6.3 is not affected by CVE-2016-5007. Both upstream fixes (MvcRequestMatcher for consistent URL pattern matching and URL-encoded slash blocking in DefaultHttpFirewall) are present in the target. The vulnerability affected versions 3.2.x, 4.0.x, 4.1.0; fixes were introduced in 4.1.1 and 4.2.4, well before version 5.6.3. The fixes shipped in the upstream release that TuxCare onboarded, authored by rwinch@gopivotal.com (upstream Spring Security developer).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 5.6.3 is not affected by CVE-2016-5007. Both upstream fixes (MvcRequestMatcher for consistent URL pattern matching and URL-encoded slash blocking in DefaultHttpFirewall) are present in the target. The vulnerability affected versions 3.2.x, 4.0.x, 4.1.0; fixes were introduced in 4.1.1 and 4.2.4, well before version 5.6.3. The fixes shipped in the upstream release that TuxCare onboarded, authored by rwinch@gopivotal.com (upstream Spring Security developer).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. The target (Spring Security 5.6.3-tuxcare.2) is not affected by CVE-2016-9879. The vulnerability was fixed in upstream Spring Security releases 3.2.10, 4.1.4, and 4.2.1 (December 2016). The fix commit 666e356ebc479194ba51e43bb99fc42f849b6175 by Rob Winch (rwinch@gopivotal.com) was already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The defense code in DefaultHttpFirewall.java checks for URL-encoded slashes (%2f/%2F) in request URIs and rejects them before security constraint evaluation, preventing the path interpretation bypass described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target (Spring Security 5.6.3-tuxcare.2) is not affected by CVE-2016-9879. The vulnerability was fixed in upstream Spring Security releases 3.2.10, 4.1.4, and 4.2.1 (December 2016). The fix commit 666e356ebc479194ba51e43bb99fc42f849b6175 by Rob Winch (rwinch@gopivotal.com) was already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The defense code in DefaultHttpFirewall.java checks for URL-encoded slashes (%2f/%2F) in request URIs and rejects them before security constraint evaluation, preventing the path interpretation bypass described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. The target repository (Spring Security 5.6.3-tuxcare.2) is NOT AFFECTED by CVE-2017-4995. The vulnerability was fixed by upstream Spring Security in commit 5dee8534cd (May 31, 2017), which introduced a whitelisting mechanism to prevent arbitrary deserialization. This fix was already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The current code uses an allowlist-based TypeIdResolver that validates class names before deserialization, blocking arbitrary class instantiation unless classes are whitelisted, have explicit mixins, or are annotated with Jackson mappings.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "The target repository (Spring Security 5.6.3-tuxcare.2) is NOT AFFECTED by CVE-2017-4995. The vulnerability was fixed by upstream Spring Security in commit 5dee8534cd (May 31, 2017), which introduced a whitelisting mechanism to prevent arbitrary deserialization. This fix was already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The current code uses an allowlist-based TypeIdResolver that validates class names before deserialization, blocking arbitrary class instantiation unless classes are whitelisted, have explicit mixins, or are annotated with Jackson mappings.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Security 5.6.3-tuxcare.2. The vulnerability (security constraint bypass via URL path parameters with special encodings) was fixed in upstream Spring Security 5.0.1 (October 2017) by introducing StrictHttpFirewall, which rejects requests containing semicolons (the path parameter delimiter). This fix was already present in the upstream Spring Security 5.6.3 ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Security 5.6.3-tuxcare.2. The vulnerability (security constraint bypass via URL path parameters with special encodings) was fixed in upstream Spring Security 5.0.1 (October 2017) by introducing StrictHttpFirewall, which rejects requests containing semicolons (the path parameter delimiter). This fix was already present in the upstream Spring Security 5.6.3 ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target is version 5.6.3, which already contains the upstream vendor's fix (commit 19649db9ce by Josh Cummings). The vulnerable pattern\u2014Java URL object comparison in JWT issuer validation\u2014is not present. The target code converts issuers to strings before comparison (via MappedJwtClaimSetConverter.convertIssuer() and JwtIssuerValidator using string comparison), matching the security fix exactly. This fix shipped with the upstream Spring Security 5.6.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target is version 5.6.3, which already contains the upstream vendor's fix (commit 19649db9ce by Josh Cummings). The vulnerable pattern\u2014Java URL object comparison in JWT issuer validation\u2014is not present. The target code converts issuers to strings before comparison (via MappedJwtClaimSetConverter.convertIssuer() and JwtIssuerValidator using string comparison), matching the security fix exactly. This fix shipped with the upstream Spring Security 5.6.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. The target Spring Security 5.6.3 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in October 2017 (commit 12dbf2e961) before the 5.0.0 release. This removal is an ancestor of the target version. The CVE explicitly states it affects \"versions 4.2.x up to 4.2.12, and older unsupported versions\" \u2014 version 5.6.3 is outside this range. PlaintextPasswordEncoder was replaced by NoOpPasswordEncoder in the crypto module, which does not have the null password vulnerability because it uses standard .equals() comparison instead of the vulnerable string concatenation pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "The target Spring Security 5.6.3 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in October 2017 (commit 12dbf2e961) before the 5.0.0 release. This removal is an ancestor of the target version. The CVE explicitly states it affects \"versions 4.2.x up to 4.2.12, and older unsupported versions\" \u2014 version 5.6.3 is outside this range. PlaintextPasswordEncoder was replaced by NoOpPasswordEncoder in the crypto module, which does not have the null password vulnerability because it uses standard .equals() comparison instead of the vulnerable string concatenation pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.3-tuxcare.2 is not affected by CVE-2019-3795. The vulnerability (insecure randomness when using SecureRandomFactoryBean#setSeed) was fixed in the upstream Spring Security release before TuxCare onboarded version 5.6.3. The fix commit 9c1eac79e2 by Josh Cummings is present in HEAD, shipped in the upstream release. The vulnerable pattern (calling setSeed() on uninitialized Sec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.3-tuxcare.2 is not affected by CVE-2019-3795. The vulnerability (insecure randomness when using SecureRandomFactoryBean#setSeed) was fixed in the upstream Spring Security release before TuxCare onboarded version 5.6.3. The fix commit 9c1eac79e2 by Josh Cummings is present in HEAD, shipped in the upstream release. The vulnerable pattern (calling setSeed() on uninitialized Sec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.6.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.6.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 describes a vulnerability in Spring Security's queryableText encryptor that uses a fixed null initialization vector with CBC mode, enabling dictionary attacks on encrypted data. The target (Spring Security 5.6.3) contains the fix applied by upstream: the queryableText() method is deprecated with @Deprecated annotation and Javadoc warning stating \"This encryptor is not secure.\" Thi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 describes a vulnerability in Spring Security's queryableText encryptor that uses a fixed null initialization vector with CBC mode, enabling dictionary attacks on encrypted data. The target (Spring Security 5.6.3) contains the fix applied by upstream: the queryableText() method is deprecated with @Deprecated annotation and Javadoc warning stating \"This encryptor is not secure.\" Thi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. The target Spring Security 5.6.3-tuxcare.2 is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unbounded OAuth2 authorization request accumulation in HTTP sessions) has been fixed by upstream commit 35f5ebdbcf. This fix was already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The target code limits authorization request storage to one request per session by default (with a deprecated opt-in for multiple requests), preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target Spring Security 5.6.3-tuxcare.2 is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unbounded OAuth2 authorization request accumulation in HTTP sessions) has been fixed by upstream commit 35f5ebdbcf. This fix was already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The target code limits authorization request storage to one request per session by default (with a deprecated opt-in for multiple requests), preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because automatic context saving removes stored authentication after logout, including serialized copies. web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:110\u2013116 saves the resulting empty context after logout. web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:328\u2013349 removes the session attribute when authentication is empty and the original context was authenticated.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because automatic context saving removes stored authentication after logout, including serialized copies. web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:110\u2013116 saves the resulting empty context after logout. web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:328\u2013349 removes the session attribute when authentication is empty and the original context was authenticated."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:53.102119+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2024-38810. The vulnerability requires MethodSecurityAdvisorRegistrar, which was introduced in Spring Security 6.x (specifically when @AuthorizeReturnObject was added in 6.2.5+) and does not exist in 5.6.3. The target uses a fundamentally different architecture for advisor registration that avoids the AspectJ auto-proxy interaction issue.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2024-38810. The vulnerability requires MethodSecurityAdvisorRegistrar, which was introduced in Spring Security 6.x (specifically when @AuthorizeReturnObject was added in 6.2.5+) and does not exist in 5.6.3. The target uses a fundamentally different architecture for advisor registration that avoids the AspectJ auto-proxy interaction issue."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:53.102119+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2025-22223. The vulnerable class UniqueSecurityAnnotationScanner was introduced in version 6.4.0 (August 2024), significantly later than this 5.6.3 release (March 2022). Version 5.6.3 uses a different annotation scanning architecture (PrePostAnnotationSecurityMetadataSource and AuthorizationAnnotationUtils) that correctly handles method security anno...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2025-22223. The vulnerable class UniqueSecurityAnnotationScanner was introduced in version 6.4.0 (August 2024), significantly later than this 5.6.3 release (March 2022). Version 5.6.3 uses a different annotation scanning architecture (PrePostAnnotationSecurityMetadataSource and AuthorizationAnnotationUtils) that correctly handles method security anno..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 5.6.3-tuxcare.2 is not affected by CVE-2025-22234. This CVE describes a regression introduced by CVE-2025-22228, which added an unconditional password length check that broke timing attack mitigation in DaoAuthenticationProvider. The vulnerable code pattern (CVE-2025-22228's unconditional length check) is not present in the target. The target retains the original BCrypt i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 5.6.3-tuxcare.2 is not affected by CVE-2025-22234. This CVE describes a regression introduced by CVE-2025-22228, which added an unconditional password length check that broke timing attack mitigation in DaoAuthenticationProvider. The vulnerable code pattern (CVE-2025-22228's unconditional length check) is not present in the target. The target retains the original BCrypt i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "action_statement": "Vulnerability CVE-2025-41232 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.6.3 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8v5q-rhf3-jphm (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.6.3 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8v5q-rhf3-jphm (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:53.102119+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.3 does not contain the One-Time Token authentication feature affected by CVE-2026-22751. The JdbcOneTimeTokenService class and entire authentication/ott package were introduced in Spring Security 6.4.0. The target version predates this feature by several major releases, therefore the vulnerable code pattern does not exist in the codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.3 does not contain the One-Time Token authentication feature affected by CVE-2026-22751. The JdbcOneTimeTokenService class and entire authentication/ott package were introduced in Spring Security 6.4.0. The target version predates this feature by several major releases, therefore the vulnerable code pattern does not exist in the codebase."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:53.102119+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.3-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class) does not exist in this version. InetAddressMatchers was introduced in Spring Security 7.1.0, which is significantly newer than the target version 5.6.3. Exhaustive repository searches confirmed the absence of the InetAddressMatchers class, matchInternal() method, and matchExte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.3-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class) does not exist in this version. InetAddressMatchers was introduced in Spring Security 7.1.0, which is significantly newer than the target version 5.6.3. Exhaustive repository searches confirmed the absence of the InetAddressMatchers class, matchInternal() method, and matchExte..."
    }
  ]
}