{
  "@id": "urn:uuid:6887ad48-71de-4cbb-96eb-67f7c10b6f29",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T18:48:00.118013+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-core 5.7.12-tuxcare.7. False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product.",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-core 5.7.12-tuxcare.7. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T20:52:13.789189+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4. The target is Spring Security 5.7.12-tuxcare.12, which includes the upstream fix from version 3.0.4 (October 2010). The fix (SEC-1584, commit 7d97adc687) introduced RequestWrapper.strip() that removes semicolon-delimited path parameters from URLs before security pattern matching, preventing attackers from bypassing sec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4. The target is Spring Security 5.7.12-tuxcare.12, which includes the upstream fix from version 3.0.4 (October 2010). The fix (SEC-1584, commit 7d97adc687) introduced RequestWrapper.strip() that removes semicolon-delimited path parameters from URLs before security pattern matching, preventing attackers from bypassing sec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T19:26:00.148611+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target (Spring Security 5.7.12) contains upstream fixes SEC-1750 and SEC-1967 that eliminate the vulnerability pattern. SEC-1750 (commit 5fce0a58bd) isolates RunAs authentication in a thread-local SecurityContext instead of a shared context, preventing cross-thread privilege escalation. SEC-1967 (commit 9a9a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target (Spring Security 5.7.12) contains upstream fixes SEC-1750 and SEC-1967 that eliminate the vulnerability pattern. SEC-1750 (commit 5fce0a58bd) isolates RunAs authentication in a thread-local SecurityContext instead of a shared context, preventing cross-thread privilege escalation. SEC-1967 (commit 9a9a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T23:02:53.904310+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732: NOT AFFECTED. The target repository (Spring Security 5.7.12-tuxcare.12) contains both defense layers from the upstream SEC-1790 fix. Layer 1: FirewalledResponse validates and rejects redirect locations containing CR/LF characters (web/src/main/java/org/springframework/security/web/firewall/FirewalledResponse.java:47). Layer 2: AbstractAuthenticationTargetUrlRequestHandler.targetU...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732: NOT AFFECTED. The target repository (Spring Security 5.7.12-tuxcare.12) contains both defense layers from the upstream SEC-1790 fix. Layer 1: FirewalledResponse validates and rejects redirect locations containing CR/LF characters (web/src/main/java/org/springframework/security/web/firewall/FirewalledResponse.java:47). Layer 2: AbstractAuthenticationTargetUrlRequestHandler.targetU..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T22:41:16.546891+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 is NOT present in Spring Security 5.7.12. The vulnerability involved deserializing entire SecurityContext objects in ContextPropagatingRemoteInvocation, allowing arbitrary code execution. The upstream fix (SEC-1741, commit b48fc53fa2, 2011-05-20) replaced SecurityContext serialization with String-based principal/credentials extraction. This fix was authored by luke.taylor@springso...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is NOT present in Spring Security 5.7.12. The vulnerability involved deserializing entire SecurityContext objects in ContextPropagatingRemoteInvocation, allowing arbitrary code execution. The upstream fix (SEC-1741, commit b48fc53fa2, 2011-05-20) replaced SecurityContext serialization with String-based principal/credentials extraction. This fix was authored by luke.taylor@springso..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T21:12:16.876091+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.7.12-tuxcare.12. The fix (SEC-2056) was already included in the upstream release before TuxCare onboarded this version. The DaoAuthenticationProvider correctly performs password validation even when the user is not found, normalizing response time and preventing username enumeration via timing side-channel attacks. Fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.7.12-tuxcare.12. The fix (SEC-2056) was already included in the upstream release before TuxCare onboarded this version. The DaoAuthenticationProvider correctly performs password validation even when the user is not found, normalizing response time and preventing username enumeration via timing side-channel attacks. Fi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T17:01:56.007074+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. The target repository (Spring Security 5.7.12-tuxcare.12) is NOT AFFECTED by CVE-2014-3527. The vulnerability was fixed by upstream Spring Security in commit 934937d9c1 (SEC-2688), which shipped in Spring Security 4.0.0+ releases, well before the target's 5.7.12 base version. The fix is fully present in the target: DefaultServiceAuthenticationDetails derives service URL host/port from trusted ServiceProperties configuration instead of from attacker-controllable HTTP Host headers. Author: rwinch@gopivotal.com (upstream), not TuxCare. Verdict: not_affected with upstream-fix attribution.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target repository (Spring Security 5.7.12-tuxcare.12) is NOT AFFECTED by CVE-2014-3527. The vulnerability was fixed by upstream Spring Security in commit 934937d9c1 (SEC-2688), which shipped in Spring Security 4.0.0+ releases, well before the target's 5.7.12 base version. The fix is fully present in the target: DefaultServiceAuthenticationDetails derives service URL host/port from trusted ServiceProperties configuration instead of from attacker-controllable HTTP Host headers. Author: rwinch@gopivotal.com (upstream), not TuxCare. Verdict: not_affected with upstream-fix attribution."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2016-5007 affects Spring Security 3.2.x, 4.0.x, and 4.1.0 due to URL pattern matching differences between Spring Security authorization and Spring MVC request routing. The target repository is Spring Security 5.7.12-tuxcare.12, which already contains the upstream vendor fix (MvcRequestMatcher using HandlerMappingIntrospector) introduced in version 4.1.1 (July 2016). The fix was authored by the upstream vendor and shipped in the upstream 5.7.12 release that TuxCare onboarded, not added as a TuxCare backport. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 affects Spring Security 3.2.x, 4.0.x, and 4.1.0 due to URL pattern matching differences between Spring Security authorization and Spring MVC request routing. The target repository is Spring Security 5.7.12-tuxcare.12, which already contains the upstream vendor fix (MvcRequestMatcher using HandlerMappingIntrospector) introduced in version 4.1.1 (July 2016). The fix was authored by the upstream vendor and shipped in the upstream 5.7.12 release that TuxCare onboarded, not added as a TuxCare backport. The vulnerable code pattern is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:05.431502+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. The target Spring Security 5.7.12-tuxcare.12 is NOT affected by CVE-2016-9879. The vulnerability (bypassing security constraints via URL-encoded slashes in path parameters) was fixed by upstream Spring Security in December 2016 (commit 666e356ebc by Rob Winch). This fix was already present in the upstream Spring Security 5.7.12 release that TuxCare onboarded. The DefaultHttpFirewall class contains the containsInvalidUrlEncodedSlash() defense method that rejects requests containing %2f or %2F in the requestURI by throwing RequestRejectedException. The fix is active by default (allowUrlEncodedSlash defaults to false) and has been part of the codebase since before TuxCare's first commit (56c6fa3abe) in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target Spring Security 5.7.12-tuxcare.12 is NOT affected by CVE-2016-9879. The vulnerability (bypassing security constraints via URL-encoded slashes in path parameters) was fixed by upstream Spring Security in December 2016 (commit 666e356ebc by Rob Winch). This fix was already present in the upstream Spring Security 5.7.12 release that TuxCare onboarded. The DefaultHttpFirewall class contains the containsInvalidUrlEncodedSlash() defense method that rejects requests containing %2f or %2F in the requestURI by throwing RequestRejectedException. The fix is active by default (allowUrlEncodedSlash defaults to false) and has been part of the codebase since before TuxCare's first commit (56c6fa3abe) in this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. The target Spring Security 5.7.12 is not affected by CVE-2017-4995. The vulnerability pattern (unrestricted class deserialization via Jackson when default typing is enabled) is not present because the upstream fix was already included in Spring Security 5.0.0.M2, which predates the 5.7.12 base version. The fix introduces an allowlist-based TypeIdResolver that validates classes before deserialization, preventing arbitrary code execution via deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "The target Spring Security 5.7.12 is not affected by CVE-2017-4995. The vulnerability pattern (unrestricted class deserialization via Jackson when default typing is enabled) is not present because the upstream fix was already included in Spring Security 5.0.0.M2, which predates the 5.7.12 base version. The fix introduces an allowlist-based TypeIdResolver that validates classes before deserialization, preventing arbitrary code execution via deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:30.480251+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.7.12-tuxcare.12 is NOT AFFECTED by CVE-2018-1199. The vulnerability allows bypassing security constraints by adding semicolons (path parameters) to URLs, exploiting servlet container inconsistencies in getPathInfo() handling. The upstream fix (StrictHttpFirewall) was introduced in Spring Security 5.0.1 via commit 0eef5b4b42 and is fully present in the target. Strict...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.7.12-tuxcare.12 is NOT AFFECTED by CVE-2018-1199. The vulnerability allows bypassing security constraints by adding semicolons (path parameters) to URLs, exploiting servlet container inconsistencies in getPathInfo() handling. The upstream fix (StrictHttpFirewall) was introduced in Spring Security 5.0.1 via commit 0eef5b4b42 and is fully present in the target. Strict..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.7.12-tuxcare.12 is NOT affected by CVE-2018-15801. The vulnerability (authorization bypass in JWT issuer validation) was fixed in the upstream Spring Security codebase before version 5.7.12 was released. The target contains the upstream fix that converts JWT issuer validation from URL object comparison (vulnerable to DNS resolution and normalization issues) to string comparison. Fix commit 19649db9ceb6db3bc5c830628e41cb3af67c50b9 by Josh Cummings (upstream) was already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "Spring Security 5.7.12-tuxcare.12 is NOT affected by CVE-2018-15801. The vulnerability (authorization bypass in JWT issuer validation) was fixed in the upstream Spring Security codebase before version 5.7.12 was released. The target contains the upstream fix that converts JWT issuer validation from URL object comparison (vulnerable to DNS resolution and normalization issues) to string comparison. Fix commit 19649db9ceb6db3bc5c830628e41cb3af67c50b9 by Josh Cummings (upstream) was already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.7.12 is not affected by CVE-2019-11272. The vulnerable component PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0 (October 2017), well before version 5.7.12 was released. The CVE explicitly states it affects 'versions 4.2.x up to 4.2.12, and older unsupported versions' - version 5.x and later are not in scope. The replacement component NoOpPasswordEncoder does not exhibit the same null-to-string conversion vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.7.12 is not affected by CVE-2019-11272. The vulnerable component PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0 (October 2017), well before version 5.7.12 was released. The CVE explicitly states it affects 'versions 4.2.x up to 4.2.12, and older unsupported versions' - version 5.x and later are not in scope. The replacement component NoOpPasswordEncoder does not exhibit the same null-to-string conversion vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-02T23:54:12.578535+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x < 4.2.12, 5.0.x < 5.0.12, and 5.1.x < 5.1.5. The target is Spring Security 5.7.12-tuxcare.12. The vulnerability (insecure randomness when using SecureRandomFactoryBean#setSeed) was fixed in upstream commit 9c1eac79e2 on 2019-03-11, approximately 5 years before the 5.7.12 release (2024-03-18). The fix ensures random.nextBytes() is called BEFOR...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x < 4.2.12, 5.0.x < 5.0.12, and 5.1.x < 5.1.5. The target is Spring Security 5.7.12-tuxcare.12. The vulnerability (insecure randomness when using SecureRandomFactoryBean#setSeed) was fixed in upstream commit 9c1eac79e2 on 2019-03-11, approximately 5 years before the 5.7.12 release (2024-03-18). The fix ensures random.nextBytes() is called BEFOR..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-06T18:39:00.080138+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.7.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.7.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T22:02:03.900703+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 affects the queryableText() method in Spring Security's Encryptors class, which uses a fixed null IV with CBC mode encryption, enabling dictionary attacks. The target version 5.7.12-tuxcare.12 already contains the upstream vendor's fix: the queryableText() method is marked @Deprecated with an explicit security warning directing users to alternative approaches. This fix was authore...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects the queryableText() method in Spring Security's Encryptors class, which uses a fixed null IV with CBC mode encryption, enabling dictionary attacks. The target version 5.7.12-tuxcare.12 already contains the upstream vendor's fix: the queryableText() method is marked @Deprecated with an explicit security warning directing users to alternative approaches. This fix was authore..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2021-22119: Spring Security 5.7.12-tuxcare.12 is NOT AFFECTED. The DoS vulnerability via unbounded OAuth2 authorization request accumulation was fixed in upstream Spring Security 5.5.1. The target version (5.7.12) already contains the fix shipped by the upstream vendor (commit 35f5ebdbcf by Craig Andrews). The defense mechanism limits each session to one pending authorization request by default, preventing memory exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119: Spring Security 5.7.12-tuxcare.12 is NOT AFFECTED. The DoS vulnerability via unbounded OAuth2 authorization request accumulation was fixed in upstream Spring Security 5.5.1. The target version (5.7.12) already contains the fix shipped by the upstream vendor (commit 35f5ebdbcf by Craig Andrews). The defense mechanism limits each session to one pending authorization request by default, preventing memory exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T05:09:50.143748+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 describes an integer overflow vulnerability in Spring Security's BCrypt implementation when using work factor 31. The vulnerable code used `int rounds = 1 << log_rounds`, which overflows to a negative value at log_rounds=31, causing the salt-round loop to skip execution. The upstream Spring Security project fixed this in commit 1229b27b87 (June 2021, author Josh Cummings) by chan...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 describes an integer overflow vulnerability in Spring Security's BCrypt implementation when using work factor 31. The vulnerable code used `int rounds = 1 << log_rounds`, which overflows to a negative value at log_rounds=31, causing the salt-round loop to skip execution. The upstream Spring Security project fixed this in commit 1229b27b87 (June 2021, author Josh Cummings) by chan..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.7.12 is NOT AFFECTED by CVE-2022-22978. The vulnerability involves RegexRequestMatcher allowing authorization bypass when HTTP request paths contain newline or carriage-return characters. The fix (adding Pattern.DOTALL flag to ensure '.' metacharacter matches newlines) was already present in the upstream Spring Security 5.7.12 release that TuxCare onboarded. Commit ee28896f42 by upstream maintainer Rob Winch introduced this fix on May 12, 2022, before TuxCare's onboarding (first TuxCare commit: 56c6fa3abe). The target code at /var/lib/vc-scratch/tmpvy956ywd/repo/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java line 46 shows 'DEFAULT = Pattern.DOTALL', confirming the defense is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "Spring Security 5.7.12 is NOT AFFECTED by CVE-2022-22978. The vulnerability involves RegexRequestMatcher allowing authorization bypass when HTTP request paths contain newline or carriage-return characters. The fix (adding Pattern.DOTALL flag to ensure '.' metacharacter matches newlines) was already present in the upstream Spring Security 5.7.12 release that TuxCare onboarded. Commit ee28896f42 by upstream maintainer Rob Winch introduced this fix on May 12, 2022, before TuxCare's onboarding (first TuxCare commit: 56c6fa3abe). The target code at /var/lib/vc-scratch/tmpvy956ywd/repo/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java line 46 shows 'DEFAULT = Pattern.DOTALL', confirming the defense is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.7.12-tuxcare.12 is NOT affected by CVE-2022-31692. The vulnerability (authorization bypass via FORWARD/INCLUDE dispatcher types) was fixed in upstream Spring Security 5.7.5 by commit 1f481aafff (authored by Marcus Da Coregio). The target version 5.7.12 naturally includes this upstream fix, which changed AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean with custom dispatcher-type-aware attribute tracking. The fix ensures FORWARD and INCLUDE dispatches receive independent authorization checks at their target endpoints, preventing the bypass. This is an upstream vendor fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Spring Security 5.7.12-tuxcare.12 is NOT affected by CVE-2022-31692. The vulnerability (authorization bypass via FORWARD/INCLUDE dispatcher types) was fixed in upstream Spring Security 5.7.5 by commit 1f481aafff (authored by Marcus Da Coregio). The target version 5.7.12 naturally includes this upstream fix, which changed AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean with custom dispatcher-type-aware attribute tracking. The fix ensures FORWARD and INCLUDE dispatches receive independent authorization checks at their target endpoints, preventing the bypass. This is an upstream vendor fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-02T22:42:49.576921+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 does not affect this version. The vulnerability (logout not properly cleaning serialized security context) was fixed in upstream Spring Security 5.7.8. The target version 5.7.12-tuxcare.12 includes the complete upstream fix (commit 2d52fb8e4b) that was already present in the base 5.7.12 release. The fix adds: (1) SecurityContextLogoutHandler now saves empty context to repository ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 does not affect this version. The vulnerability (logout not properly cleaning serialized security context) was fixed in upstream Spring Security 5.7.8. The target version 5.7.12-tuxcare.12 includes the complete upstream fix (commit 2d52fb8e4b) that was already present in the base 5.7.12 release. The fix adds: (1) SecurityContextLogoutHandler now saves empty context to repository ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:00.057265+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). The upstream fix was released in 5.7.12, which is this version. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.7.12), CVE record (last affected 5.7.11), Snyk (fixed in 5.7.12).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). The upstream fix was released in 5.7.12, which is this version. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.7.12), CVE record (last affected 5.7.11), Snyk (fixed in 5.7.12)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38810 affects Spring Security 6.3.0 and 6.3.1 due to missing authorization when using the @AuthorizeReturnObject annotation. The target repository is Spring Security version 5.7.12-tuxcare.12, which predates the introduction of this annotation. The @AuthorizeReturnObject annotation was introduced in Spring Security 6.3.0 (as documented by the @since 6.3 JavaDoc tag) and does not exist ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38810 affects Spring Security 6.3.0 and 6.3.1 due to missing authorization when using the @AuthorizeReturnObject annotation. The target repository is Spring Security version 5.7.12-tuxcare.12, which predates the introduction of this annotation. The @AuthorizeReturnObject annotation was introduced in Spring Security 6.3.0 (as documented by the @since 6.3 JavaDoc tag) and does not exist ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:00.118013+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 affects version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core, and is fixed in 5.7.12-tuxcare.13.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "action_statement": "Vulnerability CVE-2025-22223 affects version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core, and is fixed in 5.7.12-tuxcare.13."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 is fixed in version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T10:48:29.606694+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.12 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.12 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T11:36:43.630807+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 5.7.12 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 5.7.12 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.12 does not contain the One-Time Token (OTT) authentication feature that includes the vulnerable JdbcOneTimeTokenService class. The entire one-time token login functionality was introduced in Spring Security version 6.4.0 (September 2024), which is significantly later than the target version 5.7.12. Therefore, the TOCTOU race condition vulnerability CVE-2026-22751 cannot exi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.12 does not contain the One-Time Token (OTT) authentication feature that includes the vulnerable JdbcOneTimeTokenService class. The entire one-time token login functionality was introduced in Spring Security version 6.4.0 (September 2024), which is significantly later than the target version 5.7.12. Therefore, the TOCTOU race condition vulnerability CVE-2026-22751 cannot exi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T18:44:00.132301+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core, and is fixed in 5.7.12-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core, and is fixed in 5.7.12-tuxcare.11."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.12-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.7.12-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.7.12-tuxcare.12 is not affected by CVE-2026-59277. The vulnerability exists in the InetAddressMatchers utility class and its matchInternal()/matchExternal() builder methods, which classify IP addresses as internal (private) or external (public). These APIs were introduced in Spring Security versions after 5.7.x and do not exist in the target version. The target has only the ol...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.12-tuxcare.12 is not affected by CVE-2026-59277. The vulnerability exists in the InetAddressMatchers utility class and its matchInternal()/matchExternal() builder methods, which classify IP addresses as internal (private) or external (public). These APIs were introduced in Spring Security versions after 5.7.x and do not exist in the target version. The target has only the ol..."
    }
  ]
}