{ "@id": "urn:uuid:0f8a5f14-3c27-4f7b-8976-cb493f8f67f8", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T10:14:00.092544+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2007-1651 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2007-1651 describes a CSRF vulnerability in OpenID implementations where cached DiscoveryInformation tokens persist in the HTTP session after logout, allowing session restoration attacks. The upstream Spring Security project fixed this vulnerability in commit f5468087c2 (April 2010) by adding session cleanup in the endConsumption method. The target repository (Spring Security 5.8.14.tuxcare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1651" }, "impact_statement": "not_affected \u2014 CVE-2007-1651 describes a CSRF vulnerability in OpenID implementations where cached DiscoveryInformation tokens persist in the HTTP session after logout, allowing session restoration attacks. The upstream Spring Security project fixed this vulnerability in commit f5468087c2 (April 2010) by adding session cleanup in the endConsumption method. The target repository (Spring Security 5.8.14.tuxcare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-core 5.8.14-tuxcare.6. CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID\nProvider side. It does not apply to Spring Security in any version.\n\nNo affected software product is on record. The CVE record carries vendor \"n/a\", product\n\"n/a\" and version \"n/a\"; NVD lists a single unversioned CPE, cpe:2.3:a:openid:openid:*,\nwith no version bounds; the GitHub advisory GHSA-3x88-xvgr-m6fg is unreviewed and lists\nno affected package in any ecosystem; OSV has no entry for any spring-security artifact\n(control: the same query returns 5 entries for spring-security-config and 31 for\nspring-security-core); and spring.io publishes no advisory for this CVE. Every one of the\neight references points to JanRain's myOpenID security-fix announcement of March 2007 or\nto the openid.net security mailing list threads of the same month, where the reporter\nstates the problem had to be fixed on the myOpenID server.\n\nThe reported mechanism is Provider-side by construction. A crafted web page uses a cached\nauthentication token and an existing Provider session to forcibly log a user into an\nOpenID-enabled site, release the user's personal information to it, and silently add that\nsite to the user's trusted-sites list. A trusted-sites auto-approval list exists only at\nan OpenID Provider; a relying party has no such list and no auto-approval step at which\nthe flaw could occur.\n\nThe openid module of Spring Security implements only the relying-party (consumer) role.\nOpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps\nopenid4java's ConsumerManager. The only openid4java packages referenced in the tree are\nconsumer, discovery, message and association - there is no use of org.openid4java.server,\nno ServerManager, no OpenID Provider implementation, and no trusted-sites or auto-approval\nhandling of any kind. No openid4java sources are vendored into the tree.\n\nNor could this library have been affected when the issue was disclosed: the CVE was\npublished on 24 March 2007, while the earliest OpenID code in the project dates from\n20 April 2007 and only reached the shipped openid module in January 2008.\n\nResolved consistently with spring-security 5.6.10 (VPV 9976), 5.7.11 (43741),\n5.7.12 (12031), 5.7.14 (40534) and 5.8.16 (330), all closed as false_positive.", "vulnerability": { "name": "CVE-2007-1652" }, "impact_statement": "CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID\nProvider side. It does not apply to Spring Security in any version.\n\nNo affected software product is on record. The CVE record carries vendor \"n/a\", product\n\"n/a\" and version \"n/a\"; NVD lists a single unversioned CPE, cpe:2.3:a:openid:openid:*,\nwith no version bounds; the GitHub advisory GHSA-3x88-xvgr-m6fg is unreviewed and lists\nno affected package in any ecosystem; OSV has no entry for any spring-security artifact\n(control: the same query returns 5 entries for spring-security-config and 31 for\nspring-security-core); and spring.io publishes no advisory for this CVE. Every one of the\neight references points to JanRain's myOpenID security-fix announcement of March 2007 or\nto the openid.net security mailing list threads of the same month, where the reporter\nstates the problem had to be fixed on the myOpenID server.\n\nThe reported mechanism is Provider-side by construction. A crafted web page uses a cached\nauthentication token and an existing Provider session to forcibly log a user into an\nOpenID-enabled site, release the user's personal information to it, and silently add that\nsite to the user's trusted-sites list. A trusted-sites auto-approval list exists only at\nan OpenID Provider; a relying party has no such list and no auto-approval step at which\nthe flaw could occur.\n\nThe openid module of Spring Security implements only the relying-party (consumer) role.\nOpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps\nopenid4java's ConsumerManager. The only openid4java packages referenced in the tree are\nconsumer, discovery, message and association - there is no use of org.openid4java.server,\nno ServerManager, no OpenID Provider implementation, and no trusted-sites or auto-approval\nhandling of any kind. No openid4java sources are vendored into the tree.\n\nNor could this library have been affected when the issue was disclosed: the CVE was\npublished on 24 March 2007, while the earliest OpenID code in the project dates from\n20 April 2007 and only reached the shipped openid module in January 2008.\n\nResolved consistently with spring-security 5.6.10 (VPV 9976), 5.7.11 (43741),\n5.7.12 (12031), 5.7.14 (40534) and 5.8.16 (330), all closed as false_positive." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 5.8.14 is NOT affected by CVE-2010-3700. The vulnerability (bypassing security constraints via path parameters like /admin;x=y/resource) was fixed in upstream Spring Security 2.0.6/3.0.4 (October 2010) via SEC-1584. The fix introduced HttpFirewall with RequestWrapper that strips semicolon-delimited path parameters from servlet paths before pattern matching. Version 5.8.14...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2010-3700" }, "impact_statement": "not_affected \u2014 Target Spring Security 5.8.14 is NOT affected by CVE-2010-3700. The vulnerability (bypassing security constraints via path parameters like /admin;x=y/resource) was fixed in upstream Spring Security 2.0.6/3.0.4 (October 2010) via SEC-1584. The fix introduced HttpFirewall with RequestWrapper that strips semicolon-delimited path parameters from servlet paths before pattern matching. Version 5.8.14..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 5.8.14 is not affected by CVE-2011-2731. The vulnerability was fixed in upstream Spring Security in 2011 (SEC-1750 and SEC-1967), long before version 5.8.14 was released in 2023. The fix creates a new isolated SecurityContext for RunAs operations instead of modifying a shared context in place, preventing privilege escalation via race conditions. The fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2731" }, "impact_statement": "not_affected \u2014 Target Spring Security 5.8.14 is not affected by CVE-2011-2731. The vulnerability was fixed in upstream Spring Security in 2011 (SEC-1750 and SEC-1967), long before version 5.8.14 was released in 2023. The fix creates a new isolated SecurityContext for RunAs operations instead of modifying a shared context in place, preventing privilege escalation via race conditions. The fix was authored by up..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout functionality) is not present in Spring Security 5.8.14. The vulnerability required: (1) user-controlled redirect locations via the spring-security-redirect parameter, and (2) lack of CRLF validation in sendRedirect(). The target has both defenses: FirewalledResponse validates and rejects CRLF characters (commit 824464516c by Luke Taylor, July 2011), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2732" }, "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout functionality) is not present in Spring Security 5.8.14. The vulnerability required: (1) user-controlled redirect locations via the spring-security-redirect parameter, and (2) lack of CRLF validation in sendRedirect(). The target has both defenses: FirewalledResponse validates and rejects CRLF characters (commit 824464516c by Luke Taylor, July 2011), and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.14 is NOT affected by CVE-2011-2894. The vulnerable deserialization pattern was fixed by upstream Spring Security in 2011 (commit b48fc53f by Luke Taylor) and this fix was already present in the 5.8.14 release that TuxCare onboarded. The code no longer deserializes SecurityContext objects from remote clients; instead, it extracts principal and credentials as plain Strings on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 Spring Security 5.8.14 is NOT affected by CVE-2011-2894. The vulnerable deserialization pattern was fixed by upstream Spring Security in 2011 (commit b48fc53f by Luke Taylor) and this fix was already present in the 5.8.14 release that TuxCare onboarded. The code no longer deserializes SecurityContext objects from remote clients; instead, it extracts principal and credentials as plain Strings on..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 5.8.14. The vulnerability involved a timing side-channel attack where authentication failures for non-existent users were faster than failures for existing users (because password validation was skipped), allowing attackers to enumerate valid usernames. The fix introduced by upstream commit c076f0f2e190c73a17379d05935c2c81657adee9 (SEC-2056) added...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5055" }, "impact_statement": "not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 5.8.14. The vulnerability involved a timing side-channel attack where authentication failures for non-existent users were faster than failures for existing users (because password validation was skipped), allowing attackers to enumerate valid usernames. The fix introduced by upstream commit c076f0f2e190c73a17379d05935c2c81657adee9 (SEC-2056) added..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2014-0097 affects version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2014-0097" }, "action_statement": "Vulnerability CVE-2014-0097 affects version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2014-3527 is not present in Spring Security 5.8.14. The vulnerability was fixed in commit 934937d9c1 on 2014-07-24 by upstream author Rob Winch, over 10 years before this version was released. The fix was already included in the upstream 5.8.14 release that TuxCare onboarded on 2026-09-14. The code at HEAD uses the secure pattern: host/port values come from the configured ServiceProperties URL, not from attacker-controllable HTTP request headers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3527" }, "impact_statement": "CVE-2014-3527 is not present in Spring Security 5.8.14. The vulnerability was fixed in commit 934937d9c1 on 2014-07-24 by upstream author Rob Winch, over 10 years before this version was released. The fix was already included in the upstream 5.8.14 release that TuxCare onboarded on 2026-09-14. The code at HEAD uses the secure pattern: host/port values come from the configured ServiceProperties URL, not from attacker-controllable HTTP request headers." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.8.14 is not affected by CVE-2016-5007. The vulnerability, which allowed authorization bypass through URL pattern matching inconsistencies between Spring Security and Spring MVC, was fixed by upstream Spring Security in 2016 (version 4.1.x era). The target contains both defense mechanisms: (1) MvcRequestMatcher for MVC-compatible pattern matching, and (2) DefaultHttpFirewall blocking of URL-encoded slashes. These fixes were already present in the upstream Spring Security 5.8.14 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "Spring Security 5.8.14 is not affected by CVE-2016-5007. The vulnerability, which allowed authorization bypass through URL pattern matching inconsistencies between Spring Security and Spring MVC, was fixed by upstream Spring Security in 2016 (version 4.1.x era). The target contains both defense mechanisms: (1) MvcRequestMatcher for MVC-compatible pattern matching, and (2) DefaultHttpFirewall blocking of URL-encoded slashes. These fixes were already present in the upstream Spring Security 5.8.14 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2016-9879 does not affect this target. The vulnerability allows bypassing security constraints via URL-encoded slashes (%2f/%2F) in request URIs due to servlet container differences in handling path parameters. The fix (encoded slash validation in DefaultHttpFirewall) was already present in the upstream Spring Security 5.8.14 release that TuxCare onboarded, authored by Rob Winch from Pivotal in December 2016. The vulnerable pattern (missing encoded slash check) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-9879" }, "impact_statement": "CVE-2016-9879 does not affect this target. The vulnerability allows bypassing security constraints via URL-encoded slashes (%2f/%2F) in request URIs due to servlet container differences in handling path parameters. The fix (encoded slash validation in DefaultHttpFirewall) was already present in the upstream Spring Security 5.8.14 release that TuxCare onboarded, authored by Rob Winch from Pivotal in December 2016. The vulnerable pattern (missing encoded slash check) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2017-4995 does not affect Spring Security 5.8.14. The vulnerability, which allowed arbitrary code execution through Jackson deserialization with unrestricted default typing, was fixed in the upstream Spring Security project in May 2017. Version 5.8.14 already contains the fix in the form of AllowlistTypeIdResolver that validates classes against a whitelist before deserializing. The fix was part of the upstream release when it was onboarded to the TuxCare repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-4995" }, "impact_statement": "CVE-2017-4995 does not affect Spring Security 5.8.14. The vulnerability, which allowed arbitrary code execution through Jackson deserialization with unrestricted default typing, was fixed in the upstream Spring Security project in May 2017. Version 5.8.14 already contains the fix in the form of AllowlistTypeIdResolver that validates classes against a whitelist before deserializing. The fix was part of the upstream release when it was onboarded to the TuxCare repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 5.8.14. The vulnerability involved bypassing security constraints by adding URL path parameters with special encodings (semicolons). The fix (commit 0eef5b4b42) introduced StrictHttpFirewall as the default HttpFirewall, which rejects requests containing semicolons and other malicious characters. This fix was already included in the upstream Spring...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 5.8.14. The vulnerability involved bypassing security constraints by adding URL path parameters with special encodings (semicolons). The fix (commit 0eef5b4b42) introduced StrictHttpFirewall as the default HttpFirewall, which rejects requests containing semicolons and other malicious characters. This fix was already included in the upstream Spring..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.8.14 is not affected by CVE-2018-15801. The vulnerable JWT issuer validation pattern (comparing URL objects using URL.equals() which performs DNS resolution) was fixed in the upstream release before TuxCare onboarded version 5.8.14. The fix (commit 6486857462 by Christian Mouttet) changed JwtIssuerValidator to convert issuer claim values to strings before comparison, preventing DNS-based URL equivalence attacks. This upstream fix was already present when TuxCare onboarded 5.8.14 on 2024-11-03.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15801" }, "impact_statement": "Spring Security 5.8.14 is not affected by CVE-2018-15801. The vulnerable JWT issuer validation pattern (comparing URL objects using URL.equals() which performs DNS resolution) was fixed in the upstream release before TuxCare onboarded version 5.8.14. The fix (commit 6486857462 by Christian Mouttet) changed JwtIssuerValidator to convert issuer claim values to strings before comparison, preventing DNS-based URL equivalence attacks. This upstream fix was already present when TuxCare onboarded 5.8.14 on 2024-11-03.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.8.14 is NOT AFFECTED by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder does not exist in this version - it was removed from Spring Security in version 5.0.0.RC1 (October 2017), approximately 18 months before this CVE was published. The removal was part of upstream architectural improvements that migrated password encoding to the org.springframework.security.crypto.password package. All password encoders in version 5.8.14 correctly handle null encoded passwords: NoOpPasswordEncoder uses String.equals() which returns false for null comparisons, while other encoders use Utf8.isEqual() or throw exceptions on null input, preventing the authentication bypass described in the CVE. TuxCare backported the CVE-2019-11272 fix to older affected versions (3.2.8.RELEASE, 4.2.12.RELEASE, 1.0.7) that still contained PlaintextPasswordEncoder, but no backport was needed for 5.8.14 as the vulnerable code was never present in this version lineage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-11272" }, "impact_statement": "Spring Security 5.8.14 is NOT AFFECTED by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder does not exist in this version - it was removed from Spring Security in version 5.0.0.RC1 (October 2017), approximately 18 months before this CVE was published. The removal was part of upstream architectural improvements that migrated password encoding to the org.springframework.security.crypto.password package. All password encoders in version 5.8.14 correctly handle null encoded passwords: NoOpPasswordEncoder uses String.equals() which returns false for null comparisons, while other encoders use Utf8.isEqual() or throw exceptions on null input, preventing the authentication bypass described in the CVE. TuxCare backported the CVE-2019-11272 fix to older affected versions (3.2.8.RELEASE, 4.2.12.RELEASE, 1.0.7) that still contained PlaintextPasswordEncoder, but no backport was needed for 5.8.14 as the vulnerable code was never present in this version lineage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 is not present in Spring Security 5.8.14. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used - the user-provided seed would completely replace the SecureRandom internal state, making the output predictable. The upstream fix (commit 9c1eac79e2, authored by josh.cummings@gmail.com on 2019-03-11) ensures nextBytes() is called BEFORE setSeed()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-3795" }, "impact_statement": "not_affected \u2014 CVE-2019-3795 is not present in Spring Security 5.8.14. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used - the user-provided seed would completely replace the SecureRandom internal state, making the output predictable. The upstream fix (commit 9c1eac79e2, authored by josh.cummings@gmail.com on 2019-03-11) ensures nextBytes() is called BEFORE setSeed()..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.8.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5407" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 5.8.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 is not affecting this target. The vulnerability involves using a fixed null initialization vector (IV) in the queryable text encryptor, which enables dictionary attacks on encrypted data. The upstream vendor (Spring Security) applied their fix strategy by deprecating the vulnerable queryableText() method in commit db155b3094 (April 2020). This deprecation with security warning is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5408" }, "impact_statement": "not_affected \u2014 CVE-2020-5408 is not affecting this target. The vulnerability involves using a fixed null initialization vector (IV) in the queryable text encryptor, which enables dictionary attacks on encrypted data. The upstream vendor (Spring Security) applied their fix strategy by deprecating the vulnerable queryableText() method in commit db155b3094 (April 2020). This deprecation with security warning is ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. The target Spring Security 5.8.14 is NOT AFFECTED by CVE-2021-22119. The fix for this OAuth2 authorization request DoS vulnerability was already present in the upstream release before TuxCare onboarded version 5.8.14. The defensive code limits authorization requests to one per session by default (allowMultipleAuthorizationRequests=false), preventing the unbounded memory growth that enabled the DoS attack. Fix commit 35f5ebdbcf was authored by candrews@integralblue.com and is an ancestor of the first TuxCare commit (5b61a4c84b2975472ed36365c14dfae191b0a1ed - Onboard version 5.8.14), confirming this is an upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22119" }, "impact_statement": "The target Spring Security 5.8.14 is NOT AFFECTED by CVE-2021-22119. The fix for this OAuth2 authorization request DoS vulnerability was already present in the upstream release before TuxCare onboarded version 5.8.14. The defensive code limits authorization requests to one per session by default (allowMultipleAuthorizationRequests=false), preventing the unbounded memory growth that enabled the DoS attack. Fix commit 35f5ebdbcf was authored by candrews@integralblue.com and is an ancestor of the first TuxCare commit (5b61a4c84b2975472ed36365c14dfae191b0a1ed - Onboard version 5.8.14), confirming this is an upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Target repository Spring Security 5.8.14 is NOT AFFECTED by CVE-2022-22976. The integer overflow vulnerability in BCrypt's crypt_raw method (causing zero cryptographic rounds when log_rounds=31) was fixed in upstream Spring Security and shipped in version 5.8.14 before TuxCare onboarded it. The fix (commits 3f13fa0285d1 and ba0f8ec3efff by Josh Cummings) changed rounds calculation from vulnerab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22976" }, "impact_statement": "not_affected \u2014 Target repository Spring Security 5.8.14 is NOT AFFECTED by CVE-2022-22976. The integer overflow vulnerability in BCrypt's crypt_raw method (causing zero cryptographic rounds when log_rounds=31) was fixed in upstream Spring Security and shipped in version 5.8.14 before TuxCare onboarded it. The fix (commits 3f13fa0285d1 and ba0f8ec3efff by Josh Cummings) changed rounds calculation from vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2022-22978 is NOT present in Spring Security 5.8.14. The vulnerability involved RegexRequestMatcher compiling regex patterns without the DOTALL flag, allowing attackers to inject line terminators (\\n, \\r via %0A, %0D) to bypass authorization checks when patterns used `.` metacharacter. The target code at web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java:47 defines `DEFAULT = Pattern.DOTALL`, which is the fix. This fix was introduced by upstream commit 538252cf07 (authored by Rob Winch) and was already present in Spring Security 5.8.14 when TuxCare onboarded it (commit 5b61a4c84b). The vulnerable pattern (DEFAULT=0) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22978" }, "impact_statement": "CVE-2022-22978 is NOT present in Spring Security 5.8.14. The vulnerability involved RegexRequestMatcher compiling regex patterns without the DOTALL flag, allowing attackers to inject line terminators (\\n, \\r via %0A, %0D) to bypass authorization checks when patterns used `.` metacharacter. The target code at web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java:47 defines `DEFAULT = Pattern.DOTALL`, which is the fix. This fix was introduced by upstream commit 538252cf07 (authored by Rob Winch) and was already present in Spring Security 5.8.14 when TuxCare onboarded it (commit 5b61a4c84b). The vulnerable pattern (DEFAULT=0) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.8.14 is NOT affected by CVE-2022-31692. The vulnerability affects versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9, where AuthorizationFilter incorrectly extended OncePerRequestFilter, causing authorization bypass on FORWARD/INCLUDE dispatcher types. The fix (commit 1f481aafff, October 2022) replaced OncePerRequestFilter with GenericFilterBean and added explicit dispatcher-type handling. This fix was already present in the upstream Spring Security 5.8.14 release that TuxCare onboarded in September 2026. The target's AuthorizationFilter correctly extends GenericFilterBean with full dispatcher-type awareness (lines 51, 60-64, 107-115), making the vulnerable pattern absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31692" }, "impact_statement": "Spring Security 5.8.14 is NOT affected by CVE-2022-31692. The vulnerability affects versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9, where AuthorizationFilter incorrectly extended OncePerRequestFilter, causing authorization bypass on FORWARD/INCLUDE dispatcher types. The fix (commit 1f481aafff, October 2022) replaced OncePerRequestFilter with GenericFilterBean and added explicit dispatcher-type handling. This fix was already present in the upstream Spring Security 5.8.14 release that TuxCare onboarded in September 2026. The target's AuthorizationFilter correctly extends GenericFilterBean with full dispatcher-type awareness (lines 51, 60-64, 107-115), making the vulnerable pattern absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.8.14 is NOT vulnerable to CVE-2023-20862. The vulnerability (logout not properly cleaning security context from persistent storage) was fixed in upstream Spring Security 5.8.3. The target version 5.8.14 already contains both required fixes from upstream commits 2d52fb8e4b (Clear Repository on Logout) and 8d664bc4c2 (DelegatingSecurityContextRepository fix), which we...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-20862" }, "impact_statement": "not_affected \u2014 The target Spring Security 5.8.14 is NOT vulnerable to CVE-2023-20862. The vulnerability (logout not properly cleaning security context from persistent storage) was fixed in upstream Spring Security 5.8.3. The target version 5.8.14 already contains both required fixes from upstream commits 2d52fb8e4b (Clear Repository on Logout) and 8d664bc4c2 (DelegatingSecurityContextRepository fix), which we..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2024-22234 affects version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-22234" }, "action_statement": "Vulnerability CVE-2024-22234 affects version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2024-22257 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). The upstream fix was released in 5.8.11, and version 5.8.14 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.8.11), CVE record (last affected 5.8.10), Snyk (fixed in 5.8.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-22257" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 5a7f12f1). The upstream fix was released in 5.8.11, and version 5.8.14 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.8.11), CVE record (last affected 5.8.10), Snyk (fixed in 5.8.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38810 affects the @AuthorizeReturnObject annotation feature in Spring Security 6.3.0 and 6.3.1. This feature does not exist in the target version 5.8.14-tuxcare.3. The @AuthorizeReturnObject annotation was introduced in version 6.2.5 (March 2024) and is completely absent from the 5.8.14 codebase. Since the vulnerable feature does not exist in this version, the vulnerability cannot be p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38810" }, "impact_statement": "not_affected \u2014 CVE-2024-38810 affects the @AuthorizeReturnObject annotation feature in Spring Security 6.3.0 and 6.3.1. This feature does not exist in the target version 5.8.14-tuxcare.3. The @AuthorizeReturnObject annotation was introduced in version 6.2.5 (March 2024) and is completely absent from the 5.8.14 codebase. Since the vulnerable feature does not exist in this version, the vulnerability cannot be p..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-38827" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2025-22223 affects Spring Security's UniqueSecurityAnnotationScanner class introduced in version 6.4.0. Target version 5.8.14 uses a different annotation scanning implementation (AuthorizationAnnotationUtils with Spring Framework's AopUtils.getMostSpecificMethod) and does not contain the vulnerable code pattern. TuxCare backported this CVE only to version 6.4.3, confirming it does not affec...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22223" }, "impact_statement": "not_affected \u2014 CVE-2025-22223 affects Spring Security's UniqueSecurityAnnotationScanner class introduced in version 6.4.0. Target version 5.8.14 uses a different annotation scanning implementation (AuthorizationAnnotationUtils with Spring Framework's AopUtils.getMostSpecificMethod) and does not contain the vulnerable code pattern. TuxCare backported this CVE only to version 6.4.3, confirming it does not affec..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2025-22234 affects version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2025-22234" }, "action_statement": "Vulnerability CVE-2025-22234 affects version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.8.14 does not contain that scanner, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-41232" }, "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.8.14 does not contain that scanner, so it is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 5.8.14 is NOT AFFECTED by CVE-2025-41248. The vulnerable class UniqueSecurityAnnotationScanner does not exist in this version. The CVE describes an authorization bypass in Spring Security's annotation detection mechanism when using @EnableMethodSecurity with security annotations on methods in generic superclasses/interfaces with unbounded generics. However, this vulnerability was introduced in Spring Security 6.4.0 (August 2024) with the new UniqueSecurityAnnotationScanner class. Version 5.8.14 uses a fundamentally different annotation scanning mechanism (AnnotationUtils.findAnnotation from Spring Framework) that has been stable for years and does not have this generic type resolution bug. TuxCare applied the CVE fix only to version 6.4.3+ (commit 625768ebab), confirming 5.x versions are unaffected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-41248" }, "impact_statement": "Spring Security 5.8.14 is NOT AFFECTED by CVE-2025-41248. The vulnerable class UniqueSecurityAnnotationScanner does not exist in this version. The CVE describes an authorization bypass in Spring Security's annotation detection mechanism when using @EnableMethodSecurity with security annotations on methods in generic superclasses/interfaces with unbounded generics. However, this vulnerability was introduced in Spring Security 6.4.0 (August 2024) with the new UniqueSecurityAnnotationScanner class. Version 5.8.14 uses a fundamentally different annotation scanning mechanism (AnnotationUtils.findAnnotation from Spring Framework) that has been stable for years and does not have this generic type resolution bug. TuxCare applied the CVE fix only to version 6.4.3+ (commit 625768ebab), confirming 5.x versions are unaffected." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2026-22746" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.14 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire OneTimeToken authentication feature) does not exist in this version. The OneTimeToken feature was introduced in Spring Security 6.5.x on 2025-02-05, approximately 6 months after the 5.8.14 release (2024-08-19). Exhaustive searches found no OneTimeToken-related code, classes...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22751" }, "impact_statement": "not_affected \u2014 Spring Security 5.8.14 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire OneTimeToken authentication feature) does not exist in this version. The OneTimeToken feature was introduced in Spring Security 6.5.x on 2025-02-05, approximately 6 months after the 5.8.14 release (2024-08-19). Exhaustive searches found no OneTimeToken-related code, classes..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2026-59276" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.14-tuxcare.6" } } ], "timestamp": "2026-11-11T10:14:00.092544+00:00", "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.14 is NOT AFFECTED by CVE-2026-59277. The vulnerable class `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` builder methods do not exist in this version. This functionality was introduced in a later Spring Security release. The target version lacks the entire `core/src/main/java/org/springframework/security/util/matcher/` package where the vulnerable class r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59277" }, "impact_statement": "not_affected \u2014 Spring Security 5.8.14 is NOT AFFECTED by CVE-2026-59277. The vulnerable class `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` builder methods do not exist in this version. This functionality was introduced in a later Spring Security release. The target version lacks the entire `core/src/main/java/org/springframework/security/util/matcher/` package where the vulnerable class r..." } ] }