{ "@id": "urn:uuid:1b46e246-866e-4aba-b4c2-9ec5b9aa0c42", "role": "Document Creator", "author": "https://tuxcare.com", "version": 19, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T02:51:09.617037+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T17:41:41.363551+00:00", "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-3295-h9qx-r82x (affected up to 3.0.4), Snyk (affected up to 3.0.4.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2010-3700" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-3295-h9qx-r82x (affected up to 3.0.4), Snyk (affected up to 3.0.4.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T17:41:41.363551+00:00", "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4644-hg35-55m9 (affected up to 3.0.6), Snyk (affected up to 3.0.6.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2731" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4644-hg35-55m9 (affected up to 3.0.6), Snyk (affected up to 3.0.6.RELEASE)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2011-2732 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2011-2732" }, "action_statement": "Vulnerability CVE-2011-2732 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2011-2894 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2011-2894" }, "action_statement": "Vulnerability CVE-2011-2894 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T17:42:00.035349+00:00", "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-3533-rvpc-6x56 (affected up to 3.1.3), Snyk (affected up to 3.1.3.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5055" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-3533-rvpc-6x56 (affected up to 3.1.3), Snyk (affected up to 3.1.3.RELEASE)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2014-0097 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2014-0097" }, "action_statement": "Vulnerability CVE-2014-0097 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-05T12:55:00.076101+00:00", "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Spring Security 5.7.6 is not affected by CVE-2014-3527. The fix 934937d9c1 (SEC-2688) is an ancestor of tuxcare-current/5.7.6; ServiceAuthenticationDetailsSource passes ServiceProperties.getService() and DefaultServiceAuthenticationDetails builds the CAS service URL from it, not from the request scheme/host/port, so the vulnerable code is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3527" }, "impact_statement": "Spring Security 5.7.6 is not affected by CVE-2014-3527. The fix 934937d9c1 (SEC-2688) is an ancestor of tuxcare-current/5.7.6; ServiceAuthenticationDetailsSource passes ServiceProperties.getService() and DefaultServiceAuthenticationDetails builds the CAS service URL from it, not from the request scheme/host/port, so the vulnerable code is not present." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2016-5007 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2016-5007" }, "action_statement": "Vulnerability CVE-2016-5007 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2016-9879 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2016-9879" }, "action_statement": "Vulnerability CVE-2016-9879 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T18:38:00.054920+00:00", "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vhrg-v3cv-p247 (affected up to 5.0.0.M2), NVD (affected up to 5.0.0-m1), Snyk (affected up to 4.2.3.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-4995" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vhrg-v3cv-p247 (affected up to 5.0.0.M2), NVD (affected up to 5.0.0-m1), Snyk (affected up to 4.2.3.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T13:37:46.015474+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The fix for CVE-2018-1199 (upstream commit 0eef5b4b, \"Add StrictHttpFirewall\", by Rob Winch) is already present in the 5.7.6 target. It shipped in the upstream release, before the first TuxCare commit. FilterChainProxy uses StrictHttpFirewall by default, and that class rejects URLs containing semicolons.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 The fix for CVE-2018-1199 (upstream commit 0eef5b4b, \"Add StrictHttpFirewall\", by Rob Winch) is already present in the 5.7.6 target. It shipped in the upstream release, before the first TuxCare commit. FilterChainProxy uses StrictHttpFirewall by default, and that class rejects URLs containing semicolons." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T18:35:46.508104+00:00", "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-27xw-p8v6-9jjr (affected up to 5.1.2), CVE record (affected up to 5.1.2), Snyk (affected up to 5.1.2.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15801" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-27xw-p8v6-9jjr (affected up to 5.1.2), CVE record (affected up to 5.1.2), Snyk (affected up to 5.1.2.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T17:42:00.035349+00:00", "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; the fixed code and the component it belongs to are absent from this version. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-v33x-prhc-gph5 (affected up to 4.2.13), NVD (affected up to 4.2.13), CVE record (affected up to 4.2.13.RELEASE), Snyk (affected up to 4.2.13.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-11272" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; the fixed code and the component it belongs to are absent from this version. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-v33x-prhc-gph5 (affected up to 4.2.13), NVD (affected up to 4.2.13), CVE record (affected up to 4.2.13.RELEASE), Snyk (affected up to 4.2.13.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T11:58:00.031425+00:00", "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 SecureRandomFactoryBean in this target already contains the upstream fix. getObject() forces default self-seeding with nextBytes before applying the supplied seed, so a seed can no longer replace the entire generator state. The fix commit is upstream-authored and shipped in the 5.7.6 release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-3795" }, "impact_statement": "not_affected \u2014 SecureRandomFactoryBean in this target already contains the upstream fix. getObject() forces default self-seeding with nextBytes before applying the supplied seed, so a seed can no longer replace the entire generator state. The fix commit is upstream-authored and shipped in the 5.7.6 release TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T18:40:00.106473+00:00", "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5407" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.7.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T10:32:37.105437+00:00", "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The vendor fix for CVE-2020-5408 (deprecating Encryptors.queryableText and documenting it as insecure) is already in the upstream 5.7.6 release that TuxCare onboarded. Vendor commit db155b3094 is an ancestor of HEAD and predates the first TuxCare commit. The second listed commit, d1909ec9c8, is an unrelated BCryptPasswordEncoder null check; it is also on HEAD and is not part of the CVE fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5408" }, "impact_statement": "not_affected \u2014 The vendor fix for CVE-2020-5408 (deprecating Encryptors.queryableText and documenting it as insecure) is already in the upstream 5.7.6 release that TuxCare onboarded. Vendor commit db155b3094 is an ancestor of HEAD and predates the first TuxCare commit. The second listed commit, d1909ec9c8, is an unrelated BCryptPasswordEncoder null check; it is also on HEAD and is not part of the CVE fix." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2021-22119 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2021-22119" }, "action_statement": "Vulnerability CVE-2021-22119 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T10:34:56.549031+00:00", "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 BCrypt.crypt_raw no longer computes the iteration count with an int shift. It uses a long (roundsForLogRounds returns 1L << log_rounds), so a work factor of 31 can't wrap to a non-positive value and skip the salt rounds. This upstream fix shipped in the release TuxCare onboarded, and its author is not a TuxCare identity.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22976" }, "impact_statement": "not_affected \u2014 BCrypt.crypt_raw no longer computes the iteration count with an int shift. It uses a long (roundsForLogRounds returns 1L << log_rounds), so a work factor of 31 can't wrap to a non-positive value and skip the salt rounds. This upstream fix shipped in the release TuxCare onboarded, and its author is not a TuxCare identity." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2022-22978 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2022-22978" }, "action_statement": "Vulnerability CVE-2022-22978 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2022-31692 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2022-31692" }, "action_statement": "Vulnerability CVE-2022-31692 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2023-20862 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2023-20862" }, "action_statement": "Vulnerability CVE-2023-20862 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2024-22234 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-22234" }, "action_statement": "Vulnerability CVE-2024-22234 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-09T02:51:09.617037+00:00", "status_notes": "Vulnerability CVE-2024-22257 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2.", "vulnerability": { "name": "CVE-2024-22257" }, "action_statement": "Vulnerability CVE-2024-22257 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2024-38810 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-38810" }, "action_statement": "Vulnerability CVE-2024-38810 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-09T02:51:09.617037+00:00", "status_notes": "Vulnerability CVE-2024-38827 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2.", "vulnerability": { "name": "CVE-2024-38827" }, "action_statement": "Vulnerability CVE-2024-38827 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-09T02:51:09.617037+00:00", "status_notes": "Vulnerability CVE-2025-22223 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2.", "vulnerability": { "name": "CVE-2025-22223" }, "action_statement": "Vulnerability CVE-2025-22223 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T06:40:00.052852+00:00", "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2025-22234 is a regression: the CVE-2025-22228 fix (a 72-byte password limit in BCrypt that throws) broke the DaoAuthenticationProvider unknown-user timing mitigation. The target (5.7.6-tuxcare.1) has no 72-byte limit and no CVE-2025-22228 backport. BCrypt.checkpw does the full bcrypt computation for any password length, and DaoAuthenticationProvider still runs the dummy match on the unknow...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-22234" }, "impact_statement": "not_affected \u2014 CVE-2025-22234 is a regression: the CVE-2025-22228 fix (a 72-byte password limit in BCrypt that throws) broke the DaoAuthenticationProvider unknown-user timing mitigation. The target (5.7.6-tuxcare.1) has no 72-byte limit and no CVE-2025-22228 backport. BCrypt.checkpw does the full bcrypt computation for any password length, and DaoAuthenticationProvider still runs the dummy match on the unknow..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2025-41232 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2025-41232" }, "action_statement": "Vulnerability CVE-2025-41232 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2025-41248 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2025-41248" }, "action_statement": "Vulnerability CVE-2025-41248 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-09T02:51:00.069477+00:00", "status_notes": "Vulnerability CVE-2026-22746 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2.", "vulnerability": { "name": "CVE-2026-22746" }, "action_statement": "Vulnerability CVE-2026-22746 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-04T08:07:07.460514+00:00", "status_notes": "Vulnerability CVE-2026-22751 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2026-22751" }, "action_statement": "Vulnerability CVE-2026-22751 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-09T02:51:00.069477+00:00", "status_notes": "Vulnerability CVE-2026-59276 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2.", "vulnerability": { "name": "CVE-2026-59276" }, "action_statement": "Vulnerability CVE-2026-59276 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.7.6-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.7.6-tuxcare.1" } } ], "timestamp": "2026-11-06T17:26:00.027593+00:00", "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59277" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only)." } ] }