{
  "@id": "urn:uuid:2bae89a0-c71b-4713-8f0c-57797c8a1734",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T04:34:59.170907+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target (Spring Security 5.6.7) is NOT affected by CVE-2010-3700. The vulnerability allowed bypassing security constraints via path parameters (semicolon-delimited parameters in URLs like /admin.html;x=user.html). The upstream fix (commit 7d97adc687 by Luke Taylor) introduced HttpFirewall infrastructure that defends against this attack. The target uses StrictHttpFirewall by default (FilterCh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Security 5.6.7) is NOT affected by CVE-2010-3700. The vulnerability allowed bypassing security constraints via path parameters (semicolon-delimited parameters in URLs like /admin.html;x=user.html). The upstream fix (commit 7d97adc687 by Luke Taylor) introduced HttpFirewall infrastructure that defends against this attack. The target uses StrictHttpFirewall by default (FilterCh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target contains the complete fix for CVE-2011-2731 (RunAsManager race condition). The vulnerability pattern\u2014storing Authentication in a shared SecurityContext\u2014is not present. The fixes (SEC-1750 and SEC-1967) were authored by upstream Spring Security developers and shipped in Spring Security 5.6.7, which TuxCare onboarded. The target code creates isolated SecurityContext instances for RunAs...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 The target contains the complete fix for CVE-2011-2731 (RunAsManager race condition). The vulnerability pattern\u2014storing Authentication in a shared SecurityContext\u2014is not present. The fixes (SEC-1750 and SEC-1967) were authored by upstream Spring Security developers and shipped in Spring Security 5.6.7, which TuxCare onboarded. The target code creates isolated SecurityContext instances for RunAs..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.7 is NOT affected by CVE-2011-2732 (CRLF injection in logout redirect). The target contains comprehensive CRLF validation defenses that were introduced by upstream commit 824464516c (SEC-1790, author: luke.taylor@springsource.com) and were already part of the Spring Security 5.6.7 release when TuxCare onboarded it. The FirewalledResponse wrapper validates all redirect locati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.7 is NOT affected by CVE-2011-2732 (CRLF injection in logout redirect). The target contains comprehensive CRLF validation defenses that were introduced by upstream commit 824464516c (SEC-1790, author: luke.taylor@springsource.com) and were already part of the Spring Security 5.6.7 release when TuxCare onboarded it. The FirewalledResponse wrapper validates all redirect locati..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target (Spring Security 5.6.7-tuxcare.2) is NOT affected by CVE-2011-2894. The vulnerability was fixed by upstream Spring Security in commit b48fc53fa2 (SEC-1741, May 2011) and included in release 5.6.0. The fix replaced unsafe SecurityContext object serialization with transmission of only String representations of principal/credentials, preventing Java deserialization attacks. The target v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Security 5.6.7-tuxcare.2) is NOT affected by CVE-2011-2894. The vulnerability was fixed by upstream Spring Security in commit b48fc53fa2 (SEC-1741, May 2011) and included in release 5.6.0. The fix replaced unsafe SecurityContext object serialization with transmission of only String representations of principal/credentials, preventing Java deserialization attacks. The target v..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 (timing attack allowing username enumeration) is NOT present in Spring Security 5.6.7. The fix was already included in the upstream release before TuxCare onboarded it. The vulnerable pattern (password validation skipped for non-existent users) has been replaced with the SEC-2056 mitigation: `prepareTimingAttackProtection()` and `mitigateAgainstTimingAttack()` ensure password enco...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (timing attack allowing username enumeration) is NOT present in Spring Security 5.6.7. The fix was already included in the upstream release before TuxCare onboarded it. The vulnerable pattern (password validation skipped for non-existent users) has been replaced with the SEC-2056 mitigation: `prepareTimingAttackProtection()` and `mitigateAgainstTimingAttack()` ensure password enco..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. The target Spring Security 5.6.7 is not affected by CVE-2014-3527. The fix for this CAS proxy ticket authentication vulnerability was already present in the upstream Spring Security 5.6.7 release that TuxCare onboarded. The vulnerable pattern (using untrusted HTTP Host header data to construct CAS service URLs) has been replaced with the secure pattern (using trusted ServiceProperties configuration). The fix commit 934937d9c1dc20c396b96c08310b72cfa627acbf by upstream author rwinch@gopivotal.com was already an ancestor of the first TuxCare commit a7dda868dbcfcd60fd1a458898e2905e61a9f704 \"Onboard version 5.6.7\".",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target Spring Security 5.6.7 is not affected by CVE-2014-3527. The fix for this CAS proxy ticket authentication vulnerability was already present in the upstream Spring Security 5.6.7 release that TuxCare onboarded. The vulnerable pattern (using untrusted HTTP Host header data to construct CAS service URLs) has been replaced with the secure pattern (using trusted ServiceProperties configuration). The fix commit 934937d9c1dc20c396b96c08310b72cfa627acbf by upstream author rwinch@gopivotal.com was already an ancestor of the first TuxCare commit a7dda868dbcfcd60fd1a458898e2905e61a9f704 \"Onboard version 5.6.7\"."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.6.7 is not affected by CVE-2016-5007. The vulnerability was fixed in upstream Spring Security 4.1.1+ (2016) and the fixes were already present in the upstream 5.6.7 release that TuxCare onboarded. Both key mitigations exist: (1) DefaultHttpFirewall blocks URL-encoded slashes (%2f, %2F) by default via containsInvalidUrlEncodedSlash() method, and (2) MvcRequestMatcher class provides Spring MVC-aligned pattern matching to eliminate authorization bypass opportunities from pattern matching inconsistencies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 5.6.7 is not affected by CVE-2016-5007. The vulnerability was fixed in upstream Spring Security 4.1.1+ (2016) and the fixes were already present in the upstream 5.6.7 release that TuxCare onboarded. Both key mitigations exist: (1) DefaultHttpFirewall blocks URL-encoded slashes (%2f, %2F) by default via containsInvalidUrlEncodedSlash() method, and (2) MvcRequestMatcher class provides Spring MVC-aligned pattern matching to eliminate authorization bypass opportunities from pattern matching inconsistencies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2016-9879 is not present in Spring Security 5.6.7. The vulnerability allowed bypassing security constraints via URL-encoded slashes in path parameters due to inconsistent servlet container handling. The upstream fix (commit 666e356e by Rob Winch) added validation in DefaultHttpFirewall.getFirewalledRequest() to detect and reject URIs containing %2f or %2F. This fix was authored by rwinch@gopivotal.com (Pivotal/Spring, not TuxCare) and shipped in the upstream Spring Security release that TuxCare onboarded as version 5.6.7. The defensive code is present at lines 49, 59-62, 82-84, and 86-94 of DefaultHttpFirewall.java, with protection enabled by default (allowUrlEncodedSlash defaults to false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "CVE-2016-9879 is not present in Spring Security 5.6.7. The vulnerability allowed bypassing security constraints via URL-encoded slashes in path parameters due to inconsistent servlet container handling. The upstream fix (commit 666e356e by Rob Winch) added validation in DefaultHttpFirewall.getFirewalledRequest() to detect and reject URIs containing %2f or %2F. This fix was authored by rwinch@gopivotal.com (Pivotal/Spring, not TuxCare) and shipped in the upstream Spring Security release that TuxCare onboarded as version 5.6.7. The defensive code is present at lines 49, 59-62, 82-84, and 86-94 of DefaultHttpFirewall.java, with protection enabled by default (allowUrlEncodedSlash defaults to false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2017-4995 affects Spring Security 4.2.0-4.2.2 and 5.0.0.M1 due to unsafe Jackson deserialization with default typing enabled. The target (Spring Security 5.6.7-tuxcare.2) contains the upstream fix introduced in commit 5dee8534cd (shipped in upstream 5.4.0). The fix adds whitelist validation via AllowlistTypeIdResolver that blocks arbitrary class deserialization unless classes are whitelisted, have mixins, or have Jackson annotations. The vulnerable pattern (enableDefaultTyping without whitelist) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "CVE-2017-4995 affects Spring Security 4.2.0-4.2.2 and 5.0.0.M1 due to unsafe Jackson deserialization with default typing enabled. The target (Spring Security 5.6.7-tuxcare.2) contains the upstream fix introduced in commit 5dee8534cd (shipped in upstream 5.4.0). The fix adds whitelist validation via AllowlistTypeIdResolver that blocks arbitrary class deserialization unless classes are whitelisted, have mixins, or have Jackson annotations. The vulnerable pattern (enableDefaultTyping without whitelist) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.6.7 is NOT AFFECTED by CVE-2018-1199. The vulnerability allowed attackers to bypass security constraints using URL path parameters with special encodings (semicolons). The fix introduced StrictHttpFirewall, which rejects requests containing semicolons (;, %3b, %3B), encoded slashes (%2f, %2F), encoded periods (%2e, %2E), backslashes, and other malicious URL patterns...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.6.7 is NOT AFFECTED by CVE-2018-1199. The vulnerability allowed attackers to bypass security constraints using URL path parameters with special encodings (semicolons). The fix introduced StrictHttpFirewall, which rejects requests containing semicolons (;, %3b, %3B), encoded slashes (%2f, %2F), encoded periods (%2e, %2E), backslashes, and other malicious URL patterns..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. The target (Spring Security 5.6.7) is not affected by CVE-2018-15801. The vulnerability was fixed in upstream commit 19649db9ce (November 2018) which replaced unsafe URL.equals() comparison with String-based comparison. This fix was already present in Spring Security 5.6.7 before TuxCare onboarded it (first TuxCare commit a7dda868db). The current code uses issuer.equals(claimValue.toString()) which safely performs String comparison, preventing the authorization bypass that URL.equals() quirks could enable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "The target (Spring Security 5.6.7) is not affected by CVE-2018-15801. The vulnerability was fixed in upstream commit 19649db9ce (November 2018) which replaced unsafe URL.equals() comparison with String-based comparison. This fix was already present in Spring Security 5.6.7 before TuxCare onboarded it (first TuxCare commit a7dda868db). The current code uses issuer.equals(claimValue.toString()) which safely performs String comparison, preventing the authorization bypass that URL.equals() quirks could enable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.6.7 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0 (October 2017) by upstream maintainer Rob Winch, well before version 5.6.7 was released. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions that still contained the deprecated authentication.encoding package. Version 5.6.7 uses the newer crypto.password package with NoOpPasswordEncoder, which does not exhibit the vulnerable null-to-string concatenation behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.6.7 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0 (October 2017) by upstream maintainer Rob Winch, well before version 5.6.7 was released. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions that still contained the deprecated authentication.encoding package. Version 5.6.7 uses the newer crypto.password package with NoOpPasswordEncoder, which does not exhibit the vulnerable null-to-string concatenation behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.7 is not affected by CVE-2019-3795. The vulnerability affects versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5. The target version 5.6.7 already contains the upstream fix (commit 9c1eac79e2) applied in March 2019 by Josh Cummings. The vulnerable code pattern (calling setSeed without prior nextBytes initialization) is not present in the target. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.7 is not affected by CVE-2019-3795. The vulnerability affects versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5. The target version 5.6.7 already contains the upstream fix (commit 9c1eac79e2) applied in March 2019 by Josh Cummings. The vulnerable code pattern (calling setSeed without prior nextBytes initialization) is not present in the target. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.6.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.6.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.6.7 is NOT AFFECTED by CVE-2020-5408. While the vulnerable code (fixed null IV in queryableText encryptor) exists in the implementation, the upstream vendor applied their chosen fix: deprecating the queryableText() method with explicit security warnings (commit db155b3094, 2020-04-30). This upstream fix was already present in Spring Security 5.6.7 before TuxCare onb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.6.7 is NOT AFFECTED by CVE-2020-5408. While the vulnerable code (fixed null IV in queryableText encryptor) exists in the implementation, the upstream vendor applied their chosen fix: deprecating the queryableText() method with explicit security warnings (commit db155b3094, 2020-04-30). This upstream fix was already present in Spring Security 5.6.7 before TuxCare onb..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. Target version 5.6.7 is not affected by CVE-2021-22119. The vulnerable pattern (unbounded accumulation of OAuth2 authorization requests in HTTP session) was fixed in upstream Spring Security 5.5.1 via commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71, authored by Craig Andrews. The fix limits storage to one authorization request per session by default, preventing the DoS attack. The target contains this upstream fix since it was part of the 5.6.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "Target version 5.6.7 is not affected by CVE-2021-22119. The vulnerable pattern (unbounded accumulation of OAuth2 authorization requests in HTTP session) was fixed in upstream Spring Security 5.5.1 via commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71, authored by Craig Andrews. The fix limits storage to one authorization request per session by default, preventing the DoS attack. The target contains this upstream fix since it was part of the 5.6.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository is NOT affected by CVE-2022-22976. The integer overflow vulnerability in BCrypt when using work factor 31 was fixed by upstream Spring Security before version 5.6.7 was released. TuxCare onboarded version 5.6.7 which already contained the complete fix. The fix replaces int arithmetic with long arithmetic in the rounds calculation, preventing the integer overflow that would...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 The target repository is NOT affected by CVE-2022-22976. The integer overflow vulnerability in BCrypt when using work factor 31 was fixed by upstream Spring Security before version 5.6.7 was released. TuxCare onboarded version 5.6.7 which already contained the complete fix. The fix replaces int arithmetic with long arithmetic in the rounds calculation, preventing the integer overflow that would..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. Target version 5.6.7-tuxcare.2 is NOT affected by CVE-2022-22978. The vulnerability pattern (missing Pattern.DOTALL flag in RegexRequestMatcher) is not present in the target. The upstream vendor (Spring Security) applied the fix in commit 70863952 by Rob Winch, which was already included in the 5.6.7 release before TuxCare onboarded it. The fix adds Pattern.DOTALL to regex compilation, ensuring the '.' metacharacter matches line terminators (newlines/carriage returns), preventing authorization bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "Target version 5.6.7-tuxcare.2 is NOT affected by CVE-2022-22978. The vulnerability pattern (missing Pattern.DOTALL flag in RegexRequestMatcher) is not present in the target. The upstream vendor (Spring Security) applied the fix in commit 70863952 by Rob Winch, which was already included in the 5.6.7 release before TuxCare onboarded it. The fix adds Pattern.DOTALL to regex compilation, ensuring the '.' metacharacter matches line terminators (newlines/carriage returns), preventing authorization bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Configuration installs automatic context persistence (SecurityContextConfigurer.java:84), ordered before logout (FilterOrderRegistration.java:73). Loading the session context creates a response wrapper that captures its original authentication (HttpSessionSecurityContextRepository.java:126, line 313). Logout clears the holder and, by default, nulls authentication (SecurityContextLogoutHandler.java:71). The persistence filter saves the resulting context in its finally block (SecurityContextPersistenceFilter.java:112). For empty authentication with previously loaded authentication, that save explicitly removes the session attribute, including when session invalidation is disabled; serialization cannot bypass this removal through object-copy semantics (HttpSessionSecurityContextRepository.java:333).",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Configuration installs automatic context persistence (SecurityContextConfigurer.java:84), ordered before logout (FilterOrderRegistration.java:73). Loading the session context creates a response wrapper that captures its original authentication (HttpSessionSecurityContextRepository.java:126, line 313). Logout clears the holder and, by default, nulls authentication (SecurityContextLogoutHandler.java:71). The persistence filter saves the resulting context in its finally block (SecurityContextPersistenceFilter.java:112). For empty authentication with previously loaded authentication, that save explicitly removes the session attribute, including when session invalidation is disabled; serialization cannot bypass this removal through object-copy semantics (HttpSessionSecurityContextRepository.java:333)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.7 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3 and does not exist in version 5.6.7. Exhaustive searches confirm the feature, annotation, and associated classes (AuthorizeReturnObject, AuthorizeReturnObjectMethodInterceptor) are completely absent from this version. This is a Ru...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.7 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3 and does not exist in version 5.6.7. Exhaustive searches confirm the feature, annotation, and associated classes (AuthorizeReturnObject, AuthorizeReturnObjectMethodInterceptor) are completely absent from this version. This is a Ru..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Version 5.6.7 is not affected by CVE-2025-22234. This CVE describes a regression introduced by a broken fix for CVE-2025-22228, where an unconditional password length check in BCrypt broke the timing attack mitigation in DaoAuthenticationProvider. Version 5.6.7 has never received any CVE-2025-22228 fix and contains no 72-byte password length check in BCrypt. The timing attack mitigation in DaoA...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 Version 5.6.7 is not affected by CVE-2025-22234. This CVE describes a regression introduced by a broken fix for CVE-2025-22228, where an unconditional password length check in BCrypt broke the timing attack mitigation in DaoAuthenticationProvider. Version 5.6.7 has never received any CVE-2025-22228 fix and contains no 72-byte password length check in BCrypt. The timing attack mitigation in DaoA..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.6.7 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.6.7 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.x and 6.5.x releases as affected, so this version is older; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.x and 6.5.x releases as affected, so this version is older; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.6.7 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService and the entire One-Time Token authentication feature were introduced in Spring Security 6.4.0 (October 2024). Version 5.6.7, released several major versions earlier, does not contain any one-time token authentication infrastructure. The target predates the feature by multiple major releases...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.7 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService and the entire One-Time Token authentication feature were introduced in Spring Security 6.4.0 (October 2024). Version 5.6.7, released several major versions earlier, does not contain any one-time token authentication infrastructure. The target predates the feature by multiple major releases..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.6.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-11T04:34:59.170907+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.6.7 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers utility class (with matchInternal() and matchExternal() methods) does not exist in this version. This feature was introduced in later versions of Spring Security (likely 6.x). The target only contains an older, simpler IpAddressMatcher class in the web module that handles CIDR-based matching w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.6.7 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers utility class (with matchInternal() and matchExternal() methods) does not exist in this version. This feature was introduced in later versions of Spring Security (likely 6.x). The target only contains an older, simpler IpAddressMatcher class in the web module that handles CIDR-based matching w..."
    }
  ]
}