{
  "@id": "urn:uuid:09ceedad-ead4-40b9-8650-e1c4e6dad894",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 48,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:38:00.054920+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Target = Spring Security 5.8.15.tuxcare.1. The OpenID module and OpenID4JavaConsumer.java exist, so the vulnerable component is present in this project. However, the upstream fix for the CVE-2007-1651 / commit f5468087 issue is already applied: OpenID4JavaConsumer.endConsumption() clears the cached DiscoveryInformation from the HTTP session at line 136 (`request.getSession().removeAttribute(DISCOVERY_INFO_KEY);`), immediately after reading it (line 129) and before it is used for verification (line 147). This removal is exactly the one-line change the vendor patch introduced, and git history confirms upstream commit f5468087c2 (Luke Taylor, 2010) is the commit that added this line and is present in the target tree. Because the cached authentication artifact is deleted after a single use, a later replayed/forged callback finds no cached discovery info: the null-check at lines 130-133 then throws \"DiscoveryInformation is not available. Possible causes are lost session or replay attack\", so a logged-out user's session cannot be restored via a cached token. The pre-fix vulnerable pattern (read cached discovery info WITHOUT removing it) is not present in HEAD. The fix is upstream-authored (springsource.com domain), not a TuxCare backport, so the verdict is not_affected with justification code_not_present. The TuxCare work at HEAD (merge of JAVAELSCVE-1165) only updates oauth2/saml2 .gradle build files and is unrelated to OpenID. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "not_affected \u2014 Target = Spring Security 5.8.15.tuxcare.1. The OpenID module and OpenID4JavaConsumer.java exist, so the vulnerable component is present in this project. However, the upstream fix for the CVE-2007-1651 / commit f5468087 issue is already applied: OpenID4JavaConsumer.endConsumption() clears the cached DiscoveryInformation from the HTTP session at line 136 (`request.getSession().removeAttribute(DISCOVERY_INFO_KEY);`), immediately after reading it (line 129) and before it is used for verification (line 147). This removal is exactly the one-line change the vendor patch introduced, and git history confirms upstream commit f5468087c2 (Luke Taylor, 2010) is the commit that added this line and is present in the target tree. Because the cached authentication artifact is deleted after a single use, a later replayed/forged callback finds no cached discovery info: the null-check at lines 130-133 then throws \"DiscoveryInformation is not available. Possible causes are lost session or replay attack\", so a logged-out user's session cannot be restored via a cached token. The pre-fix vulnerable pattern (read cached discovery info WITHOUT removing it) is not present in HEAD. The fix is upstream-authored (springsource.com domain), not a TuxCare backport, so the verdict is not_affected with justification code_not_present. The TuxCare work at HEAD (merge of JAVAELSCVE-1165) only updates oauth2/saml2 .gradle build files and is unrelated to OpenID. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-core 5.8.15.tuxcare.1. CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID\nProvider side. It does not apply to Spring Security in any version.\n\nNo affected software product is on record. The CVE record carries vendor \"n/a\", product\n\"n/a\" and version \"n/a\"; NVD lists a single unversioned CPE, cpe:2.3:a:openid:openid:*,\nwith no version bounds; the GitHub advisory GHSA-3x88-xvgr-m6fg is unreviewed and lists\nno affected package in any ecosystem; OSV has no entry for any spring-security artifact\n(control: the same query returns 5 entries for spring-security-config and 31 for\nspring-security-core); and spring.io publishes no advisory for this CVE. Every one of the\neight references points to JanRain's myOpenID security-fix announcement of March 2007 or\nto the openid.net security mailing list threads of the same month, where the reporter\nstates the problem had to be fixed on the myOpenID server.\n\nThe reported mechanism is Provider-side by construction. A crafted web page uses a cached\nauthentication token and an existing Provider session to forcibly log a user into an\nOpenID-enabled site, release the user's personal information to it, and silently add that\nsite to the user's trusted-sites list. A trusted-sites auto-approval list exists only at\nan OpenID Provider; a relying party has no such list and no auto-approval step at which\nthe flaw could occur.\n\nThe openid module of Spring Security implements only the relying-party (consumer) role.\nOpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps\nopenid4java's ConsumerManager. The only openid4java packages referenced in the tree are\nconsumer, discovery, message and association - there is no use of org.openid4java.server,\nno ServerManager, no OpenID Provider implementation, and no trusted-sites or auto-approval\nhandling of any kind. No openid4java sources are vendored into the tree.\n\nNor could this library have been affected when the issue was disclosed: the CVE was\npublished on 24 March 2007, while the earliest OpenID code in the project dates from\n20 April 2007 and only reached the shipped openid module in January 2008.\n\nResolved consistently with spring-security 5.6.10 (VPV 9976), 5.7.11 (43741),\n5.7.12 (12031), 5.7.14 (40534) and 5.8.16 (330), all closed as false_positive.",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID\nProvider side. It does not apply to Spring Security in any version.\n\nNo affected software product is on record. The CVE record carries vendor \"n/a\", product\n\"n/a\" and version \"n/a\"; NVD lists a single unversioned CPE, cpe:2.3:a:openid:openid:*,\nwith no version bounds; the GitHub advisory GHSA-3x88-xvgr-m6fg is unreviewed and lists\nno affected package in any ecosystem; OSV has no entry for any spring-security artifact\n(control: the same query returns 5 entries for spring-security-config and 31 for\nspring-security-core); and spring.io publishes no advisory for this CVE. Every one of the\neight references points to JanRain's myOpenID security-fix announcement of March 2007 or\nto the openid.net security mailing list threads of the same month, where the reporter\nstates the problem had to be fixed on the myOpenID server.\n\nThe reported mechanism is Provider-side by construction. A crafted web page uses a cached\nauthentication token and an existing Provider session to forcibly log a user into an\nOpenID-enabled site, release the user's personal information to it, and silently add that\nsite to the user's trusted-sites list. A trusted-sites auto-approval list exists only at\nan OpenID Provider; a relying party has no such list and no auto-approval step at which\nthe flaw could occur.\n\nThe openid module of Spring Security implements only the relying-party (consumer) role.\nOpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps\nopenid4java's ConsumerManager. The only openid4java packages referenced in the tree are\nconsumer, discovery, message and association - there is no use of org.openid4java.server,\nno ServerManager, no OpenID Provider implementation, and no trusted-sites or auto-approval\nhandling of any kind. No openid4java sources are vendored into the tree.\n\nNor could this library have been affected when the issue was disclosed: the CVE was\npublished on 24 March 2007, while the earliest OpenID code in the project dates from\n20 April 2007 and only reached the shipped openid module in January 2008.\n\nResolved consistently with spring-security 5.6.10 (VPV 9976), 5.7.11 (43741),\n5.7.12 (12031), 5.7.14 (40534) and 5.8.16 (330), all closed as false_positive."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T20:49:20.151625+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 path parameter bypass vulnerability is NOT present in Spring Security 5.8.15. The upstream fix (commit 7d97adc687 by luke.taylor@springsource.com, dated 2010-10-03, part of Spring Security 3.1.0.M1) was already included in the upstream release that TuxCare onboarded. The fix introduces HttpFirewall with RequestWrapper that strips path parameters (everything after semicolons) from ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 path parameter bypass vulnerability is NOT present in Spring Security 5.8.15. The upstream fix (commit 7d97adc687 by luke.taylor@springsource.com, dated 2010-10-03, part of Spring Security 3.1.0.M1) was already included in the upstream release that TuxCare onboarded. The fix introduces HttpFirewall with RequestWrapper that strips path parameters (everything after semicolons) from ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:21:00.085443+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.15 is NOT affected by CVE-2011-2731. The vulnerability, which involved a race condition where the RunAsManager stored Authentication in a shared SecurityContext allowing privilege escalation across threads, was fixed in upstream commits SEC-1750 (5fce0a58bd, July 2011) and SEC-1967 (9a9aafaeec, July 2012). Both fixes were authored by upstream Spring Security developers (Luke...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.15 is NOT affected by CVE-2011-2731. The vulnerability, which involved a race condition where the RunAsManager stored Authentication in a shared SecurityContext allowing privilege escalation across threads, was fixed in upstream commits SEC-1750 (5fce0a58bd, July 2011) and SEC-1967 (9a9aafaeec, July 2012). Both fixes were authored by upstream Spring Security developers (Luke..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:59:00.114476+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 is not present in Spring Security 5.8.15. The vulnerability allowed CRLF injection via the spring-security-redirect parameter in logout flows, enabling HTTP response splitting attacks. Both upstream fixes (SEC-1790 and SEC-1648) were already present in the Spring Security 5.8.15 release before TuxCare onboarding: (1) FirewalledResponse validates and rejects any redirect locations ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 is not present in Spring Security 5.8.15. The vulnerability allowed CRLF injection via the spring-security-redirect parameter in logout flows, enabling HTTP response splitting attacks. Both upstream fixes (SEC-1790 and SEC-1648) were already present in the Spring Security 5.8.15 release before TuxCare onboarding: (1) FirewalledResponse validates and rejects any redirect locations ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:36:28.853898+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 deserialization vulnerability is NOT present in Spring Security 5.8.15. The fix (SEC-1741) was already included in the upstream release. The vulnerable pattern (deserializing entire SecurityContext objects in ContextPropagatingRemoteInvocation) was replaced with safe string-only transmission in commit b48fc53fa2 by Luke Taylor on May 20, 2011. This fix predates TuxCare's onboardin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 deserialization vulnerability is NOT present in Spring Security 5.8.15. The fix (SEC-1741) was already included in the upstream release. The vulnerable pattern (deserializing entire SecurityContext objects in ContextPropagatingRemoteInvocation) was replaced with safe string-only transmission in commit b48fc53fa2 by Luke Taylor on May 20, 2011. This fix predates TuxCare's onboardin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:09:31.945165+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 (SEC-2056) is NOT present in Spring Security 5.8.15. The timing attack vulnerability in DaoAuthenticationProvider was fixed by upstream commit c076f0f2e190c73a17379d05935c2c81657adee9 (authored by Rob Winch <rwinch@vmware.com> on 2012-09-21). This fix was already included in Spring Security 5.8.15 when TuxCare onboarded it. The target code at cd65ef22b3 contains the complete defen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (SEC-2056) is NOT present in Spring Security 5.8.15. The timing attack vulnerability in DaoAuthenticationProvider was fixed by upstream commit c076f0f2e190c73a17379d05935c2c81657adee9 (authored by Rob Winch <rwinch@vmware.com> on 2012-09-21). This fix was already included in Spring Security 5.8.15 when TuxCare onboarded it. The target code at cd65ef22b3 contains the complete defen..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T16:59:55.924062+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. Spring Security 5.8.15 is not affected by CVE-2014-3527. The vulnerability affected versions 3.1.x (< 3.1.7) and 3.2.x (< 3.2.5) and was fixed in 2014 (SEC-2688). Version 5.8.15 was released years later and shipped with the fix already integrated. The target code uses the configured service URL (via ServiceProperties) for host, port, and scheme instead of untrusted HTTP request headers, preventing attackers from impersonating other CAS services during proxy ticket validation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "Spring Security 5.8.15 is not affected by CVE-2014-3527. The vulnerability affected versions 3.1.x (< 3.1.7) and 3.2.x (< 3.2.5) and was fixed in 2014 (SEC-2688). Version 5.8.15 was released years later and shipped with the fix already integrated. The target code uses the configured service URL (via ServiceProperties) for host, port, and scheme instead of untrusted HTTP request headers, preventing attackers from impersonating other CAS services during proxy ticket validation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. CVE-2016-5007 is NOT present in Spring Security 5.8.15. Both fixes (MvcRequestMatcher for aligned URL matching and DefaultHttpFirewall's encoded slash blocking) were shipped by the upstream Spring Security vendor in the 5.8.15 release, NOT applied as TuxCare backports. The vulnerable pattern described in the CVE\u2014URL pattern matching discrepancies between Spring Security authorization rules and Spring MVC routing that allow authorization bypass\u2014is not present because the upstream vendor's fixes were already included in the 5.8.15 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Security 5.8.15. Both fixes (MvcRequestMatcher for aligned URL matching and DefaultHttpFirewall's encoded slash blocking) were shipped by the upstream Spring Security vendor in the 5.8.15 release, NOT applied as TuxCare backports. The vulnerable pattern described in the CVE\u2014URL pattern matching discrepancies between Spring Security authorization rules and Spring MVC routing that allow authorization bypass\u2014is not present because the upstream vendor's fixes were already included in the 5.8.15 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:01:20.989527+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. Target Spring Security 5.8.15 is NOT AFFECTED by CVE-2016-9879. The vulnerability (URL-encoded slash bypass via path parameters) was fixed in upstream Spring Security commit 666e356ebc by Rob Winch (Pivotal). This fix was already present in the upstream 5.8.15 release before TuxCare onboarded it. The defense code in DefaultHttpFirewall.java (lines 49, 60-62, 86-94) actively rejects requests containing %2f or %2F in the requestURI by default, preventing the attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Target Spring Security 5.8.15 is NOT AFFECTED by CVE-2016-9879. The vulnerability (URL-encoded slash bypass via path parameters) was fixed in upstream Spring Security commit 666e356ebc by Rob Winch (Pivotal). This fix was already present in the upstream 5.8.15 release before TuxCare onboarded it. The defense code in DefaultHttpFirewall.java (lines 49, 60-62, 86-94) actively rejects requests containing %2f or %2F in the requestURI by default, preventing the attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. Spring Security 5.8.15 is NOT affected by CVE-2017-4995. The upstream vendor (Spring Security project) fixed this Jackson deserialization vulnerability in commit 5dee8534cd (May 2017) by replacing unrestricted default typing with whitelist-based type validation. This fix was already present in the Spring Security 5.8.15 release that TuxCare onboarded. The vulnerable pattern (unrestricted class instantiation during JSON deserialization) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 5.8.15 is NOT affected by CVE-2017-4995. The upstream vendor (Spring Security project) fixed this Jackson deserialization vulnerability in commit 5dee8534cd (May 2017) by replacing unrestricted default typing with whitelist-based type validation. This fix was already present in the Spring Security 5.8.15 release that TuxCare onboarded. The vulnerable pattern (unrestricted class instantiation during JSON deserialization) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:13.566328+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.8.15 repository is NOT AFFECTED by CVE-2018-1199. The upstream fix for this vulnerability (commit 0eef5b4b42) was already present in the Spring Security 5.8.15 release that TuxCare onboarded. The fix introduces StrictHttpFirewall, which rejects HTTP requests containing semicolons (raw or encoded) and other special character encodings in URL path parameters, preventi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.8.15 repository is NOT AFFECTED by CVE-2018-1199. The upstream fix for this vulnerability (commit 0eef5b4b42) was already present in the Spring Security 5.8.15 release that TuxCare onboarded. The fix introduces StrictHttpFirewall, which rejects HTTP requests containing semicolons (raw or encoded) and other special character encodings in URL path parameters, preventi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. The target Spring Security 5.8.15 is not affected by CVE-2018-15801. The vulnerability (issuer validation using Java URL.equals() which can produce false positives via DNS resolution or URL normalization) was fixed in Spring Security 5.1.2 (November 2018) by upstream commit 19649db9ce. This fix changed issuer validation from URL object comparison to string comparison. The fix is present in the upstream 5.8.15 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport. The target code uses string-based issuer comparison via JwtClaimValidator with a predicate that calls issuer.equals(claimValue.toString()), and MappedJwtClaimSetConverter.convertIssuer() returns Strings (via URL.toExternalForm()) rather than URL objects, implementing the same defense as the patch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "The target Spring Security 5.8.15 is not affected by CVE-2018-15801. The vulnerability (issuer validation using Java URL.equals() which can produce false positives via DNS resolution or URL normalization) was fixed in Spring Security 5.1.2 (November 2018) by upstream commit 19649db9ce. This fix changed issuer validation from URL object comparison to string comparison. The fix is present in the upstream 5.8.15 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport. The target code uses string-based issuer comparison via JwtClaimValidator with a predicate that calls issuer.equals(claimValue.toString()), and MappedJwtClaimSetConverter.convertIssuer() returns Strings (via URL.toExternalForm()) rather than URL objects, implementing the same defense as the patch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. Spring Security 5.8.15 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security in version 5.0.0 (October 2017), years before this version. The CVE affects only versions 4.2.x and earlier that still contained this deprecated class. The removal was an upstream change by Rob Winch that shipped in all 5.x releases.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.8.15 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security in version 5.0.0 (October 2017), years before this version. The CVE affects only versions 4.2.x and earlier that still contained this deprecated class. The removal was an upstream change by Rob Winch that shipped in all 5.x releases.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T23:53:16.670486+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.8.15 repository is NOT affected by CVE-2019-3795. The vulnerability was fixed in upstream commit 9c1eac79e2 (March 2019) by Josh Cummings, which was already included in the Spring Security 5.8.15 release that TuxCare onboarded. The fix ensures SecureRandom.nextBytes() is called BEFORE setSeed(), preventing user-provided seeds from replacing the entire entropy state ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.8.15 repository is NOT affected by CVE-2019-3795. The vulnerability was fixed in upstream commit 9c1eac79e2 (March 2019) by Josh Cummings, which was already included in the Spring Security 5.8.15 release that TuxCare onboarded. The fix ensures SecureRandom.nextBytes() is called BEFORE setSeed(), preventing user-provided seeds from replacing the entire entropy state ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:38:00.054920+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.8.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.8.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.8.15 is NOT affected by CVE-2020-5408. The vulnerable queryableText() encryptor method has been deprecated with an explicit security warning by upstream Spring Security (commit db155b3094, April 2020). The deprecation, which is the vendor's chosen fix strategy, is present in the target at crypto/src/main/java/org/springframework/security/crypto/encrypt/Encryptors.ja...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.8.15 is NOT affected by CVE-2020-5408. The vulnerable queryableText() encryptor method has been deprecated with an explicit security warning by upstream Spring Security (commit db155b3094, April 2020). The deprecation, which is the vendor's chosen fix strategy, is present in the target at crypto/src/main/java/org/springframework/security/crypto/encrypt/Encryptors.ja..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. CVE-2021-22119 is NOT present in Spring Security 5.8.15-tuxcare.3. The vulnerability (DoS via unlimited accumulation of OAuth2 authorization requests in HTTP session memory) was fixed in the upstream Spring Security 5.8.15 release. The fix (commit 35f5ebdbcf by Craig Andrews) changes HttpSessionOAuth2AuthorizationRequestRepository to store only ONE authorization request per session by default, preventing memory exhaustion attacks. This upstream fix was already present when TuxCare onboarded version 5.8.15, so the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 is NOT present in Spring Security 5.8.15-tuxcare.3. The vulnerability (DoS via unlimited accumulation of OAuth2 authorization requests in HTTP session memory) was fixed in the upstream Spring Security 5.8.15 release. The fix (commit 35f5ebdbcf by Craig Andrews) changes HttpSessionOAuth2AuthorizationRequestRepository to store only ONE authorization request per session by default, preventing memory exhaustion attacks. This upstream fix was already present when TuxCare onboarded version 5.8.15, so the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:11:00.089232+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.15 is not affected by CVE-2022-22976 (BCrypt integer overflow). The upstream fix was already present in the release before TuxCare onboarding. The fix (commit 3f13fa0285d1 from 2021-06-17 by josh.cummings@gmail.com) changed the rounds calculation from `int rounds = 1 << log_rounds` to `long rounds = roundsForLogRounds(log_rounds)` where roundsForLogRounds uses `1L << log_rou...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.15 is not affected by CVE-2022-22976 (BCrypt integer overflow). The upstream fix was already present in the release before TuxCare onboarding. The fix (commit 3f13fa0285d1 from 2021-06-17 by josh.cummings@gmail.com) changed the rounds calculation from `int rounds = 1 << log_rounds` to `long rounds = roundsForLogRounds(log_rounds)` where roundsForLogRounds uses `1L << log_rou..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. CVE-2022-22978 is NOT present in spring-security 5.8.15. The vulnerability concerns RegexRequestMatcher which could be bypassed when using `.` in regex patterns, as the dot did not match newline characters (CR/LF) by default, allowing authorization bypass on some servlet containers. The upstream fix (commit 538252cf) changed `DEFAULT = 0` to `DEFAULT = Pattern.DOTALL`, ensuring `.` matches newlines consistently. This fix was included in the upstream Spring Security 5.8.15 release before TuxCare onboarded it (first TuxCare commit b44490807c \"Onboard version 5.8.15\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 is NOT present in spring-security 5.8.15. The vulnerability concerns RegexRequestMatcher which could be bypassed when using `.` in regex patterns, as the dot did not match newline characters (CR/LF) by default, allowing authorization bypass on some servlet containers. The upstream fix (commit 538252cf) changed `DEFAULT = 0` to `DEFAULT = Pattern.DOTALL`, ensuring `.` matches newlines consistently. This fix was included in the upstream Spring Security 5.8.15 release before TuxCare onboarded it (first TuxCare commit b44490807c \"Onboard version 5.8.15\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. Spring Security 5.8.15 is NOT affected by CVE-2022-31692. The vulnerability (authorization bypass via forward/include dispatcher types) was fixed upstream in commit 1f481aafff (October 2022) by changing AuthorizationFilter from OncePerRequestFilter to GenericFilterBean with explicit dispatcher-type controls. This fix was already present in the upstream Spring Security 5.8.15 release (October 2024), which TuxCare subsequently onboarded. The vulnerable code pattern (OncePerRequestFilter base class that prevented authorization checks on FORWARD/INCLUDE dispatchers) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Spring Security 5.8.15 is NOT affected by CVE-2022-31692. The vulnerability (authorization bypass via forward/include dispatcher types) was fixed upstream in commit 1f481aafff (October 2022) by changing AuthorizationFilter from OncePerRequestFilter to GenericFilterBean with explicit dispatcher-type controls. This fix was already present in the upstream Spring Security 5.8.15 release (October 2024), which TuxCare subsequently onboarded. The vulnerable code pattern (OncePerRequestFilter base class that prevented authorization checks on FORWARD/INCLUDE dispatchers) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T22:40:42.716029+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 affects Spring Security versions 5.8.x prior to 5.8.3. The target is Spring Security 5.8.15, which already contains both upstream fixes (commits 8d664bc4c2 and 2d52fb8e4b) that address the logout security context cleanup issue. The vulnerable pattern is not present because these fixes were included in the upstream 5.8.15 release before TuxCare onboarding.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 affects Spring Security versions 5.8.x prior to 5.8.3. The target is Spring Security 5.8.15, which already contains both upstream fixes (commits 8d664bc4c2 and 2d52fb8e4b) that address the logout security context cleanup issue. The vulnerable pattern is not present because these fixes were included in the upstream 5.8.15 release before TuxCare onboarding."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:00.057265+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 5.8.11, and version 5.8.15 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.8.11), CVE record (last affected 5.8.10), Snyk (fixed in 5.8.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 5.8.11, and version 5.8.15 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 5.8.11), CVE record (last affected 5.8.10), Snyk (fixed in 5.8.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:49:36.466974+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.15 is not affected by CVE-2024-38810. The vulnerability is specific to the @AuthorizeReturnObject annotation feature, which was introduced in Spring Security 6.2.x and does not exist in version 5.8.15. The CVE affects only versions 6.3.0 and 6.3.1 where this feature has a missing authorization issue. Since the target version predates the introduction of this feature by sever...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.15 is not affected by CVE-2024-38810. The vulnerability is specific to the @AuthorizeReturnObject annotation feature, which was introduced in Spring Security 6.2.x and does not exist in version 5.8.15. The CVE affects only versions 6.3.0 and 6.3.1 where this feature has a missing authorization issue. Since the target version predates the introduction of this feature by sever..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T17:25:00.075132+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.8.15-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.8.15-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:11:01.060172+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Version 5.8.15 is not affected by CVE-2025-22223. The vulnerability exists in the UniqueSecurityAnnotationScanner class introduced in Spring Security 6.4, which uses getDeclaredMethod() with raw parameter types that fail to match methods with resolved generic types. Version 5.8.15 predates this architecture and uses a different annotation scanning mechanism (AuthorizationAnnotationUtils + Sprin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Version 5.8.15 is not affected by CVE-2025-22223. The vulnerability exists in the UniqueSecurityAnnotationScanner class introduced in Spring Security 6.4, which uses getDeclaredMethod() with raw parameter types that fail to match methods with resolved generic types. Version 5.8.15 predates this architecture and uses a different annotation scanning mechanism (AuthorizationAnnotationUtils + Sprin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target version (5.8.15, SHA 7ee34e1f12) does not have the timing attack vulnerability described in CVE-2025-22234. This vulnerability was introduced by CVE-2025-22228, which added an unconditional password length check to BCrypt.hashpw() that broke timing attack mitigation in DaoAuthenticationProvider. The target version never had CVE-2025-22228 applied - it retains the original safe implem...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 The target version (5.8.15, SHA 7ee34e1f12) does not have the timing attack vulnerability described in CVE-2025-22234. This vulnerability was introduced by CVE-2025-22228, which added an unconditional password length check to BCrypt.hashpw() that broke timing attack mitigation in DaoAuthenticationProvider. The target version never had CVE-2025-22228 applied - it retains the original safe implem..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:48:29.606694+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.8.15 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.8.15 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. Spring Security 5.8.15 is NOT AFFECTED by CVE-2025-41248. The vulnerability exists only in the UniqueSecurityAnnotationScanner class, which was introduced in version 6.4.0-M4 (August 2024), after the 5.8.15 release. The target version uses a different annotation detection mechanism (AuthorizationAnnotationUtils + Spring Framework's AnnotationUtils.findAnnotation()) that does not contain the vulnerable code pattern (.resolve() returning null for unbounded generics in method parameter type matching). No backport was provided for 5.8.x versions by either Spring Security upstream or TuxCare, confirming this version is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 5.8.15 is NOT AFFECTED by CVE-2025-41248. The vulnerability exists only in the UniqueSecurityAnnotationScanner class, which was introduced in version 6.4.0-M4 (August 2024), after the 5.8.15 release. The target version uses a different annotation detection mechanism (AuthorizationAnnotationUtils + Spring Framework's AnnotationUtils.findAnnotation()) that does not contain the vulnerable code pattern (.resolve() returning null for unbounded generics in method parameter type matching). No backport was provided for 5.8.x versions by either Spring Security upstream or TuxCare, confirming this version is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T17:26:00.157035+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.8.15-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      },
      "action_statement": "Vulnerability CVE-2026-22746 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.8.15-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.15 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService does not exist in this version. The entire One-Time Token (OTT) authentication feature, including JdbcOneTimeTokenService, was introduced in Spring Security 6.4.0 (milestone 3), which postdates this 5.8.15 release by multiple major versions. Without the OTT feature, the TOCTOU race conditi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.15 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService does not exist in this version. The entire One-Time Token (OTT) authentication feature, including JdbcOneTimeTokenService, was introduced in Spring Security 6.4.0 (milestone 3), which postdates this 5.8.15 release by multiple major versions. Without the OTT feature, the TOCTOU race conditi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T17:26:00.157035+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.8.15-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 5.8.15-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.8.15.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.8.15.tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.8.15 is not affected by CVE-2026-59277. The vulnerable `InetAddressMatchers` utility class with `matchInternal()` and `matchExternal()` methods does not exist in this version. Exhaustive searches across the codebase, git history, and even newer versions (up to 6.5.11) found no trace of this class or its methods. The only related code is `IpAddressMatcher`, a basic IP/subnet ma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.8.15 is not affected by CVE-2026-59277. The vulnerable `InetAddressMatchers` utility class with `matchInternal()` and `matchExternal()` methods does not exist in this version. Exhaustive searches across the codebase, git history, and even newer versions (up to 6.5.11) found no trace of this class or its methods. The only related code is `IpAddressMatcher`, a basic IP/subnet ma..."
    }
  ]
}