{
  "@id": "urn:uuid:7edbed11-c4d3-42ce-bb7e-02c13897b835",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T03:52:58.479594+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 is not present in Spring Security 5.6.5. The vulnerability allowed attackers to bypass security constraints by injecting path parameters (semicolons) into URLs. The fix (SEC-1584) was authored by Luke Taylor from SpringSource and shipped in the upstream release before TuxCare onboarding. The target uses StrictHttpFirewall by default, which actively rejects URLs containing semicolo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 is not present in Spring Security 5.6.5. The vulnerability allowed attackers to bypass security constraints by injecting path parameters (semicolons) into URLs. The fix (SEC-1584) was authored by Luke Taylor from SpringSource and shipped in the upstream release before TuxCare onboarding. The target uses StrictHttpFirewall by default, which actively rejects URLs containing semicolo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 5.6.5-tuxcare.1) is NOT AFFECTED by CVE-2011-2731. The vulnerability was fixed in upstream Spring Security releases 2.0.7 and 3.0.6 (circa 2011), and both the primary fix (SEC-1750, commit 5fce0a58bd) and the complementary fix (SEC-1967, commit 9a9aafaeec) are present in the target codebase. These fixes were already included in the upstream Spring Security...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 5.6.5-tuxcare.1) is NOT AFFECTED by CVE-2011-2731. The vulnerability was fixed in upstream Spring Security releases 2.0.7 and 3.0.6 (circa 2011), and both the primary fix (SEC-1750, commit 5fce0a58bd) and the complementary fix (SEC-1967, commit 9a9aafaeec) are present in the target codebase. These fixes were already included in the upstream Spring Security..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.6.5-tuxcare.1 is NOT affected by CVE-2011-2732 (CRLF injection in logout redirect). The vulnerability was fixed in upstream Spring Security versions 2.0.7 and 3.0.6 (released in 2011). The fix is present in the target through commit 824464516ceb9783fe26b967a5797f09c265e5b1 authored by luke.taylor@springsource.com, which predates the TuxCare onboarding. The fix valid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.6.5-tuxcare.1 is NOT affected by CVE-2011-2732 (CRLF injection in logout redirect). The vulnerability was fixed in upstream Spring Security versions 2.0.7 and 3.0.6 (released in 2011). The fix is present in the target through commit 824464516ceb9783fe26b967a5797f09c265e5b1 authored by luke.taylor@springsource.com, which predates the TuxCare onboarding. The fix valid..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 affects Spring Security versions that deserialize entire SecurityContext objects in RMI remote invocations, enabling remote code execution via malicious serialized payloads. The target repository (Spring Security 5.6.5-tuxcare.1) is NOT AFFECTED because the upstream vendor fix (commit b48fc53fa2) was already included in the upstream 5.6.5 release before TuxCare onboarding. The vul...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security versions that deserialize entire SecurityContext objects in RMI remote invocations, enabling remote code execution via malicious serialized payloads. The target repository (Spring Security 5.6.5-tuxcare.1) is NOT AFFECTED because the upstream vendor fix (commit b48fc53fa2) was already included in the upstream 5.6.5 release before TuxCare onboarding. The vul..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Target version 5.6.5 is NOT AFFECTED by CVE-2012-5055. The timing attack vulnerability (SEC-2056) was fixed in upstream Spring Security on 2012-09-21 by Rob Winch (commit c076f0f2e1), long before the 5.6.5 release. The fix\u2014which performs password validation against a dummy encoded password even when a user is not found\u2014was already present in the upstream 5.6.5 release that TuxCare onboarded. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 Target version 5.6.5 is NOT AFFECTED by CVE-2012-5055. The timing attack vulnerability (SEC-2056) was fixed in upstream Spring Security on 2012-09-21 by Rob Winch (commit c076f0f2e1), long before the 5.6.5 release. The fix\u2014which performs password validation against a dummy encoded password even when a user is not found\u2014was already present in the upstream 5.6.5 release that TuxCare onboarded. Th..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2014-3527 is NOT present in Spring Security 5.6.5. The vulnerability involved CAS proxy ticket authentication using untrusted HTTP Host headers to construct service URLs, allowing attackers to bypass access control restrictions between CAS services. The fix (commit 934937d9c1 from 2014-07-24 by upstream author rwinch@gopivotal.com) was already included in the upstream Spring Security 5.6.5 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target - DefaultServiceAuthenticationDetails constructor now takes a trusted casService URL parameter and extracts protocol/host/port from it, rather than reading these values from HttpServletRequest headers.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 is NOT present in Spring Security 5.6.5. The vulnerability involved CAS proxy ticket authentication using untrusted HTTP Host headers to construct service URLs, allowing attackers to bypass access control restrictions between CAS services. The fix (commit 934937d9c1 from 2014-07-24 by upstream author rwinch@gopivotal.com) was already included in the upstream Spring Security 5.6.5 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target - DefaultServiceAuthenticationDetails constructor now takes a trusted casService URL parameter and extracts protocol/host/port from it, rather than reading these values from HttpServletRequest headers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. Target Spring Security 5.6.5-tuxcare.1 is NOT AFFECTED by CVE-2016-5007. Both upstream fixes addressing URL pattern matching inconsistencies between Spring Security and Spring MVC were already present in the upstream 5.6.5 release: (1) MvcRequestMatcher class providing MVC-consistent pattern matching (commit e4c13e3c0ee7, July 2016), and (2) DefaultHttpFirewall's URL-encoded slash blocking (commit 6d30da2e1f16, December 2016). These fixes were authored by Rob Winch and shipped in Spring Security 4.1.1+ releases. The vulnerable code patterns are absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Target Spring Security 5.6.5-tuxcare.1 is NOT AFFECTED by CVE-2016-5007. Both upstream fixes addressing URL pattern matching inconsistencies between Spring Security and Spring MVC were already present in the upstream 5.6.5 release: (1) MvcRequestMatcher class providing MVC-consistent pattern matching (commit e4c13e3c0ee7, July 2016), and (2) DefaultHttpFirewall's URL-encoded slash blocking (commit 6d30da2e1f16, December 2016). These fixes were authored by Rob Winch and shipped in Spring Security 4.1.1+ releases. The vulnerable code patterns are absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. The target Spring Security 5.6.5 is NOT affected by CVE-2016-9879. The vulnerability was fixed in upstream releases 3.2.10, 4.1.4, and 4.2.1 (December 2016), and the fix was already present in the upstream 5.6.5 release that TuxCare onboarded. The DefaultHttpFirewall class at HEAD contains the complete fix: the containsInvalidUrlEncodedSlash() method (lines 86-94) rejects any request URI containing %2f or %2F, preventing attackers from bypassing security constraints via URL-encoded slashes. Fix commit 666e356ebc is an ancestor of HEAD and was authored by upstream Spring Security (rwinch@gopivotal.com), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target Spring Security 5.6.5 is NOT affected by CVE-2016-9879. The vulnerability was fixed in upstream releases 3.2.10, 4.1.4, and 4.2.1 (December 2016), and the fix was already present in the upstream 5.6.5 release that TuxCare onboarded. The DefaultHttpFirewall class at HEAD contains the complete fix: the containsInvalidUrlEncodedSlash() method (lines 86-94) rejects any request URI containing %2f or %2F, preventing attackers from bypassing security constraints via URL-encoded slashes. Fix commit 666e356ebc is an ancestor of HEAD and was authored by upstream Spring Security (rwinch@gopivotal.com), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 5.6.5 is NOT affected by CVE-2017-4995. The vulnerability concerned unsafe Jackson deserialization allowing arbitrary code execution when default typing was enabled without whitelist protection. The fix (commit 5dee8534cd from May 31, 2017) introduced AllowlistTypeIdResolver that validates class names before deserialization, rejecting classes not in an allowlist, explicitly mapped via mixins, or annotated with Jackson annotations. This fix was already present in upstream Spring Security 5.6.5 when TuxCare onboarded it (October 29, 2026), appearing in the codebase 9+ years before onboarding. The target contains the complete protection mechanism at core/src/main/java/org/springframework/security/jackson2/SecurityJackson2Modules.java lines 90-274.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 5.6.5 is NOT affected by CVE-2017-4995. The vulnerability concerned unsafe Jackson deserialization allowing arbitrary code execution when default typing was enabled without whitelist protection. The fix (commit 5dee8534cd from May 31, 2017) introduced AllowlistTypeIdResolver that validates class names before deserialization, rejecting classes not in an allowlist, explicitly mapped via mixins, or annotated with Jackson annotations. This fix was already present in upstream Spring Security 5.6.5 when TuxCare onboarded it (October 29, 2026), appearing in the codebase 9+ years before onboarding. The target contains the complete protection mechanism at core/src/main/java/org/springframework/security/jackson2/SecurityJackson2Modules.java lines 90-274.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 describes a URL path parameter bypass vulnerability in Spring Security where semicolons in URLs could bypass security constraints. The target repository (Spring Security 5.6.5-tuxcare.1) contains the complete fix introduced by upstream commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 (Oct 2017). This fix was already present in the upstream 5.6.5 release that TuxCare onboarded. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 describes a URL path parameter bypass vulnerability in Spring Security where semicolons in URLs could bypass security constraints. The target repository (Spring Security 5.6.5-tuxcare.1) contains the complete fix introduced by upstream commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 (Oct 2017). This fix was already present in the upstream 5.6.5 release that TuxCare onboarded. The ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 5.6.5 is not affected by CVE-2018-15801. The vulnerability, which involved comparing JWT issuer claims as URL objects (allowing bypass via URL normalization/resolution), was fixed in upstream Spring Security 5.1.2. The target version 5.6.5 already contains the upstream fix that compares issuer claims as strings. The fix commit (19649db9ce \"Leave Issuer As String\" by josh.cummings@gmail.com) was part of the upstream 5.6.5 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "Spring Security 5.6.5 is not affected by CVE-2018-15801. The vulnerability, which involved comparing JWT issuer claims as URL objects (allowing bypass via URL normalization/resolution), was fixed in upstream Spring Security 5.1.2. The target version 5.6.5 already contains the upstream fix that compares issuer claims as strings. The fix commit (19649db9ce \"Leave Issuer As String\" by josh.cummings@gmail.com) was part of the upstream 5.6.5 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security versions 4.2.x up to 4.2.12 and older. The target version 5.6.5 is NOT AFFECTED because PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0.0.RC1 (October 2017). The vulnerable class does not exist in the target repository at HEAD. The CVE's affected version range explicitly excludes Spring Security 5.x and later versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security versions 4.2.x up to 4.2.12 and older. The target version 5.6.5 is NOT AFFECTED because PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0.0.RC1 (October 2017). The vulnerable class does not exist in the target repository at HEAD. The CVE's affected version range explicitly excludes Spring Security 5.x and later versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 does not affect Spring Security 5.6.5. The vulnerability affects versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5. Version 5.6.5 is significantly newer and already contains the upstream fix from commit 9c1eac79e2 (authored by Josh Cummings on March 11, 2019). The fix ensures that SecureRandom.nextBytes() is called BEFORE setSeed() to initialize the P...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 does not affect Spring Security 5.6.5. The vulnerability affects versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5. Version 5.6.5 is significantly newer and already contains the upstream fix from commit 9c1eac79e2 (authored by Josh Cummings on March 11, 2019). The fix ensures that SecureRandom.nextBytes() is called BEFORE setSeed() to initialize the P..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.6.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.6.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.6.5-tuxcare.1 is NOT affected by CVE-2020-5408. The vulnerability concerns the queryableText() encryptor using a fixed null initialization vector with CBC mode, allowing dictionary attacks. The upstream vendor (Spring Security) fixed this by deprecating the insecure queryableText() method in commit db155b30941, which was already present in the upstream release 5.6.5...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.6.5-tuxcare.1 is NOT affected by CVE-2020-5408. The vulnerability concerns the queryableText() encryptor using a fixed null initialization vector with CBC mode, allowing dictionary attacks. The upstream vendor (Spring Security) fixed this by deprecating the insecure queryableText() method in commit db155b30941, which was already present in the upstream release 5.6.5..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. The target Spring Security 5.6.5 is NOT AFFECTED by CVE-2021-22119. The vulnerability's denial-of-service pattern (unlimited accumulation of OAuth2 authorization requests in session storage) is not present in the target code. The fix was authored upstream by Craig Andrews (commit 35f5ebdbcf) and shipped with the Spring Security 5.6.5 release before TuxCare onboarded this version. The target code contains the complete mitigation: by default, only ONE authorization request is stored per session (overwriting previous requests), preventing resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target Spring Security 5.6.5 is NOT AFFECTED by CVE-2021-22119. The vulnerability's denial-of-service pattern (unlimited accumulation of OAuth2 authorization requests in session storage) is not present in the target code. The fix was authored upstream by Craig Andrews (commit 35f5ebdbcf) and shipped with the Spring Security 5.6.5 release before TuxCare onboarded this version. The target code contains the complete mitigation: by default, only ONE authorization request is stored per session (overwriting previous requests), preventing resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 affects Spring Security versions 5.5.x prior to 5.5.7 and 5.6.x prior to 5.6.4. The target repository is Spring Security version 5.6.5, which is above the fixed version threshold (5.6.4). Code analysis confirms the fix is present: the vulnerable integer overflow pattern has been replaced with safe long arithmetic. The fix was included in the upstream Spring Security 5.6.5 release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 affects Spring Security versions 5.5.x prior to 5.5.7 and 5.6.x prior to 5.6.4. The target repository is Spring Security version 5.6.5, which is above the fixed version threshold (5.6.4). Code analysis confirms the fix is present: the vulnerable integer overflow pattern has been replaced with safe long arithmetic. The fix was included in the upstream Spring Security 5.6.5 release..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2022-22978 fix (Pattern.DOTALL in RegexRequestMatcher) was already present in the upstream Spring Security 5.6.5 release that TuxCare onboarded. The vulnerable pattern where `.` in regex fails to match line terminators (\\n, \\r) does not exist in the target. Commit 70863952ae by upstream author rwinch@users.noreply.github.com added the fix before the TuxCare onboarding commit 03dfa51e64.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 fix (Pattern.DOTALL in RegexRequestMatcher) was already present in the upstream Spring Security 5.6.5 release that TuxCare onboarded. The vulnerable pattern where `.` in regex fails to match line terminators (\\n, \\r) does not exist in the target. Commit 70863952ae by upstream author rwinch@users.noreply.github.com added the fix before the TuxCare onboarding commit 03dfa51e64.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout automatically saves an empty security context and removes stored authentication. The filter saves the context after logout in web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:112. For requests that began authenticated, web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:333 removes the session attribute when the context is empty, including serialized contexts with session invalidation disabled.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout automatically saves an empty security context and removes stored authentication. The filter saves the context after logout in web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:112. For requests that began authenticated, web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:333 removes the session attribute when the context is empty, including serialized contexts with session invalidation disabled."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.5-tuxcare.1 is NOT AFFECTED by CVE-2024-38810. The vulnerability specifically affects Spring Security 6.3.0 and 6.3.1 due to a flaw in the MethodSecurityAdvisorRegistrar component that could register multiple advisors for the same annotation, rendering security annotations ineffective. Version 5.6.5 uses a completely different architecture: direct bean registration in config...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.5-tuxcare.1 is NOT AFFECTED by CVE-2024-38810. The vulnerability specifically affects Spring Security 6.3.0 and 6.3.1 due to a flaw in the MethodSecurityAdvisorRegistrar component that could register multiple advisors for the same annotation, rendering security annotations ineffective. Version 5.6.5 uses a completely different architecture: direct bean registration in config..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2025-22234 is a regression vulnerability introduced by the fix for CVE-2025-22228. The target version (5.6.5-tuxcare.1) does not contain the CVE-2025-22228 fix, therefore it cannot have the CVE-2025-22234 regression. The vulnerable code pattern (unconditional 72-byte password length check that breaks timing attack mitigation) is not present in the target codebase.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 is a regression vulnerability introduced by the fix for CVE-2025-22228. The target version (5.6.5-tuxcare.1) does not contain the CVE-2025-22228 fix, therefore it cannot have the CVE-2025-22234 regression. The vulnerable code pattern (unconditional 72-byte password length check that breaks timing attack mitigation) is not present in the target codebase."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "action_statement": "Vulnerability CVE-2025-41232 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.6.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8v5q-rhf3-jphm (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.6.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8v5q-rhf3-jphm (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.5-tuxcare.1 is NOT affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) does not exist in this version. The OTT feature was introduced in Spring Security 6.5.x on 2025-02-05, which is 7535 commits and an entire major version after the target. The target predates the vulnerable code by design.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.5-tuxcare.1 is NOT affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) does not exist in this version. The OTT feature was introduced in Spring Security 6.5.x on 2025-02-05, which is 7535 commits and an entire major version after the target. The target predates the vulnerable code by design."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.5 is not affected by CVE-2026-59277. The vulnerable `InetAddressMatchers` class with `matchInternal()` and `matchExternal()` methods doesn't exist in this version. `InetAddressMatchers` was introduced in Spring Security 7.1 (March 2026), approximately 4 years after version 5.6.5 was released (May 2022). The target has an older `IpAddressMatcher` class that serves a different...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.5 is not affected by CVE-2026-59277. The vulnerable `InetAddressMatchers` class with `matchInternal()` and `matchExternal()` methods doesn't exist in this version. `InetAddressMatchers` was introduced in Spring Security 7.1 (March 2026), approximately 4 years after version 5.6.5 was released (May 2022). The target has an older `IpAddressMatcher` class that serves a different..."
    }
  ]
}