{
  "@id": "urn:uuid:573b161d-8c18-4c3d-b121-701c240e5dfb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T19:13:13.380013+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.0.7 is not affected by CVE-2010-3700. The vulnerability allowed bypassing security constraints by adding path parameters (semicolon-delimited parameters like ;x=y) to URLs. The fix\u2014HttpFirewall with path parameter stripping/rejection\u2014was introduced in Spring Security 3.1.0.M1 (October 2010, commit 7d97adc687 by Luke Taylor) and has been part of every release since. Version 6.0...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.7 is not affected by CVE-2010-3700. The vulnerability allowed bypassing security constraints by adding path parameters (semicolon-delimited parameters like ;x=y) to URLs. The fix\u2014HttpFirewall with path parameter stripping/rejection\u2014was introduced in Spring Security 3.1.0.M1 (October 2010, commit 7d97adc687 by Luke Taylor) and has been part of every release since. Version 6.0..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target version 6.0.7 (released in 2023) already contains the upstream vendor fixes SEC-1750 and SEC-1967 from 2011-2012 that address this race condition vulnerability. The fixes create an isolated SecurityContext for RunAs operations and ensure proper restoration via finally blocks. These fixes were shipped ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target version 6.0.7 (released in 2023) already contains the upstream vendor fixes SEC-1750 and SEC-1967 from 2011-2012 that address this race condition vulnerability. The fixes create an isolated SecurityContext for RunAs operations and ensure proper restoration via finally blocks. These fixes were shipped ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 6.0.7. The vulnerability affected versions before 2.0.7 and 3.0.x before 3.0.6. The target contains comprehensive CRLF injection defenses that were introduced by upstream Spring Security in 2011 (SEC-1790/SEC-1903) and shipped with all subsequent releases including 6.0.7. Two defense layers exist: (1) FirewalledResponse validates and rejects redir...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 6.0.7. The vulnerability affected versions before 2.0.7 and 3.0.x before 3.0.6. The target contains comprehensive CRLF injection defenses that were introduced by upstream Spring Security in 2011 (SEC-1790/SEC-1903) and shipped with all subsequent releases including 6.0.7. Two defense layers exist: (1) FirewalledResponse validates and rejects redir..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 affects the ContextPropagatingRemoteInvocation class in Spring Security's RMI remoting functionality, which deserializes SecurityContext objects from untrusted sources, allowing remote code execution. The entire remoting module (including the vulnerable class) was removed from Spring Security in version 6.0.0 by upstream commit b2e6c60d94. The target version 6.0.7 is after this re...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects the ContextPropagatingRemoteInvocation class in Spring Security's RMI remoting functionality, which deserializes SecurityContext objects from untrusted sources, allowing remote code execution. The entire remoting module (including the vulnerable class) was removed from Spring Security in version 6.0.0 by upstream commit b2e6c60d94. The target version 6.0.7 is after this re..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 6.0.7. The timing attack vulnerability in DaoAuthenticationProvider was fixed by upstream Spring Security in commit c076f0f2e190 (Sept 2012, Rob Winch) and shipped in version 3.1.3.RELEASE. The target version 6.0.7 (onboarded by TuxCare in 2026) already contains this upstream fix. The code includes prepareTimingAttackProtection() and mitigateAgain...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 6.0.7. The timing attack vulnerability in DaoAuthenticationProvider was fixed by upstream Spring Security in commit c076f0f2e190 (Sept 2012, Rob Winch) and shipped in version 3.1.3.RELEASE. The target version 6.0.7 (onboarded by TuxCare in 2026) already contains this upstream fix. The code includes prepareTimingAttackProtection() and mitigateAgain..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.7 is not affected by CVE-2014-3527: the spring-security-cas module was removed upstream for 6.0 by commit caf4c47105 (2021) and only restored in 6.1 (b4d3ac6665), so tuxcare-current/6.0.7 contains no CAS code (no DefaultServiceAuthenticationDetails/ServiceAuthenticationDetailsSource) and the vulnerable proxy-ticket service-URL logic is not present. | Says CAS was \"completely removed from Spring Security 6.x\". That is misleading: CAS was removed only for 6.0 and restored in 6.1 by b4d3ac6665, and 6.1.5 through 6.5.11 ship it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "Spring Security 6.0.7 is not affected by CVE-2014-3527: the spring-security-cas module was removed upstream for 6.0 by commit caf4c47105 (2021) and only restored in 6.1 (b4d3ac6665), so tuxcare-current/6.0.7 contains no CAS code (no DefaultServiceAuthenticationDetails/ServiceAuthenticationDetailsSource) and the vulnerable proxy-ticket service-URL logic is not present. | Says CAS was \"completely removed from Spring Security 6.x\". That is misleading: CAS was removed only for 6.0 and restored in 6.1 by b4d3ac6665, and 6.1.5 through 6.5.11 ship it."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.7-tuxcare.2 is not affected by CVE-2016-5007. The vulnerability concerns pattern-matching discrepancies between Spring Security's authorization rules and Spring MVC's request routing that could allow bypass of security constraints. The upstream Spring Security project fixed this issue with two commits: (1) MvcRequestMatcher (e4c13e3c0e, 2016-07-01) providing pattern matching aligned with Spring MVC, and (2) DefaultHttpFirewall blocking URL-encoded slashes (666e356ebc, 2016-12-07). Both fixes, authored by Rob Winch (upstream maintainer), were already present in the upstream Spring Security 6.0.7 release that TuxCare onboarded (commit 5d1e0318b9). Additionally, StrictHttpFirewall (recommended since 4.2.4) provides even stricter default protection. The vulnerable pattern (missing validation of encoded slashes and pattern-matching discrepancies) is not present in the shipped code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 6.0.7-tuxcare.2 is not affected by CVE-2016-5007. The vulnerability concerns pattern-matching discrepancies between Spring Security's authorization rules and Spring MVC's request routing that could allow bypass of security constraints. The upstream Spring Security project fixed this issue with two commits: (1) MvcRequestMatcher (e4c13e3c0e, 2016-07-01) providing pattern matching aligned with Spring MVC, and (2) DefaultHttpFirewall blocking URL-encoded slashes (666e356ebc, 2016-12-07). Both fixes, authored by Rob Winch (upstream maintainer), were already present in the upstream Spring Security 6.0.7 release that TuxCare onboarded (commit 5d1e0318b9). Additionally, StrictHttpFirewall (recommended since 4.2.4) provides even stricter default protection. The vulnerable pattern (missing validation of encoded slashes and pattern-matching discrepancies) is not present in the shipped code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. Target Spring Security 5.6.3-tuxcare.1 is NOT AFFECTED by CVE-2016-9879. The vulnerability pattern (missing validation of URL-encoded slashes in requestURI that could bypass security constraints) is not present in the target because the upstream vendor (Spring Security team) already fixed this issue in commit 666e356ebc (Dec 2016), which shipped in the upstream release that TuxCare onboarded. The fix code at DefaultHttpFirewall.java lines 59-62 and 86-94 exactly matches the vendor patches, implementing containsInvalidUrlEncodedSlash() to reject requests with %2f or %2F before processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Target Spring Security 5.6.3-tuxcare.1 is NOT AFFECTED by CVE-2016-9879. The vulnerability pattern (missing validation of URL-encoded slashes in requestURI that could bypass security constraints) is not present in the target because the upstream vendor (Spring Security team) already fixed this issue in commit 666e356ebc (Dec 2016), which shipped in the upstream release that TuxCare onboarded. The fix code at DefaultHttpFirewall.java lines 59-62 and 86-94 exactly matches the vendor patches, implementing containsInvalidUrlEncodedSlash() to reject requests with %2f or %2F before processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.7 is not affected by CVE-2017-4995. The vulnerable pattern (unvalidated deserialization of arbitrary classes via Jackson with default typing) is not present because the upstream fix was already included in version 6.0.7. The fix introduces AllowlistTypeIdResolver which validates all class instantiations during deserialization, blocking untrusted classes unless they are allowlisted, have explicit mixins, or have Jackson annotations. Fix commit 5dee8534cd by upstream author Rob Winch shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 6.0.7 is not affected by CVE-2017-4995. The vulnerable pattern (unvalidated deserialization of arbitrary classes via Jackson with default typing) is not present because the upstream fix was already included in version 6.0.7. The fix introduces AllowlistTypeIdResolver which validates all class instantiations during deserialization, blocking untrusted classes unless they are allowlisted, have explicit mixins, or have Jackson annotations. Fix commit 5dee8534cd by upstream author Rob Winch shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.0.7 is not affected by CVE-2018-1199. The vulnerability pattern (path parameter bypass using semicolons and special encodings) is not present because the upstream fix was already included in the Spring Security 6.0.7 release. The StrictHttpFirewall class (introduced in Spring Security 5.0.1) blocks semicolons, encoded slashes, encoded periods, and other malicious patterns by d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.7 is not affected by CVE-2018-1199. The vulnerability pattern (path parameter bypass using semicolons and special encodings) is not present because the upstream fix was already included in the Spring Security 6.0.7 release. The StrictHttpFirewall class (introduced in Spring Security 5.0.1) blocks semicolons, encoded slashes, encoded periods, and other malicious patterns by d..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2018-15801 is NOT present in Spring Security 6.0.7-tuxcare.2. The vulnerability involved using Java URL object equality for JWT issuer validation, which performs DNS resolution and could allow different issuer strings resolving to the same host to be treated as equal. The upstream fix (commit 19649db9ce by Josh Cummings) changed to string-based comparison and was already included in Spring Security 6.0.7 when TuxCare onboarded it. The current code uses string comparison via issuer.equals(claimValue.toString()), preventing the DNS-based bypass. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 is NOT present in Spring Security 6.0.7-tuxcare.2. The vulnerability involved using Java URL object equality for JWT issuer validation, which performs DNS resolution and could allow different issuer strings resolving to the same host to be treated as equal. The upstream fix (commit 19649db9ce by Josh Cummings) changed to string-based comparison and was already included in Spring Security 6.0.7 when TuxCare onboarded it. The current code uses string comparison via issuer.equals(claimValue.toString()), preventing the DNS-based bypass. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x and older versions. The vulnerable class PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0 (October 2017) by upstream author Rob Winch. Version 6.0.7 does not contain this class and uses modern password encoders (BCrypt, Argon2, PBKDF2, SCrypt, DelegatingPasswordEncoder) that do not have the null-to-string conversion vulnerability. The removal was an upstream change that shipped in the base release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x and older versions. The vulnerable class PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0 (October 2017) by upstream author Rob Winch. Version 6.0.7 does not contain this class and uses modern password encoders (BCrypt, Argon2, PBKDF2, SCrypt, DelegatingPasswordEncoder) that do not have the null-to-string conversion vulnerability. The removal was an upstream change that shipped in the base release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 due to insecure randomness when using SecureRandomFactoryBean#setSeed. The target version 6.0.7-tuxcare.2 is NOT affected because the upstream Spring Security project already fixed this vulnerability in March 2019 (commit 9c1eac79e2, authored by Josh Cummings), and that fix was ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 due to insecure randomness when using SecureRandomFactoryBean#setSeed. The target version 6.0.7-tuxcare.2 is NOT affected because the upstream Spring Security project already fixed this vulnerability in March 2019 (commit 9c1eac79e2, authored by Josh Cummings), and that fix was ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.0.7 is NOT affected by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that used a fixed null initialization vector with AES-CBC encryption was completely removed in upstream Spring Security 6.0.0 (commit d996c2a2c6d14c4e578cb56019737922060fd7da, Sept 2022). The CVE explicitly scopes the vulnerability to \"the queryable text encryptor\" implementation, not to t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.7 is NOT affected by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that used a fixed null initialization vector with AES-CBC encryption was completely removed in upstream Spring Security 6.0.0 (commit d996c2a2c6d14c4e578cb56019737922060fd7da, Sept 2022). The CVE explicitly scopes the vulnerability to \"the queryable text encryptor\" implementation, not to t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.7-tuxcare.2 is NOT AFFECTED by CVE-2021-22119. The vulnerable pattern (unbounded Map storage of OAuth2 authorization requests leading to DoS via memory exhaustion) is not present in the target. The upstream fix commit 35f5ebdbcf was already included in the 6.0.7 release when TuxCare onboarded it. The code stores only ONE authorization request per session, with each new request overwriting the previous one, preventing unbounded memory growth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "Spring Security 6.0.7-tuxcare.2 is NOT AFFECTED by CVE-2021-22119. The vulnerable pattern (unbounded Map storage of OAuth2 authorization requests leading to DoS via memory exhaustion) is not present in the target. The upstream fix commit 35f5ebdbcf was already included in the 6.0.7 release when TuxCare onboarded it. The code stores only ONE authorization request per session, with each new request overwriting the previous one, preventing unbounded memory growth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 affects Spring Security versions with a BCrypt integer overflow vulnerability where work factor 31 causes zero cryptographic iterations. The target (Spring Security 6.0.7-tuxcare.2) is NOT AFFECTED because upstream fixes (commits e6297d3bf7 from 2021-06-17 and b0b4612609 from 2022-07-11) were already present in the upstream 6.0.7 release that TuxCare onboarded on 2026-09-14. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 affects Spring Security versions with a BCrypt integer overflow vulnerability where work factor 31 causes zero cryptographic iterations. The target (Spring Security 6.0.7-tuxcare.2) is NOT AFFECTED because upstream fixes (commits e6297d3bf7 from 2021-06-17 and b0b4612609 from 2022-07-11) were already present in the upstream 6.0.7 release that TuxCare onboarded on 2026-09-14. The ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2022-22978 describes an authorization bypass vulnerability in Spring Security's RegexRequestMatcher when using `.` in regex patterns. Without the Pattern.DOTALL flag, the `.` metacharacter does not match newline characters (\\n, \\r), allowing attackers to bypass regex-based authorization rules by injecting newlines into request paths (e.g., /admin%0a/sensitive bypassing /admin.* protection). The target repository (Spring Security 6.0.7-tuxcare.2) contains the fix: Pattern.DOTALL is set as the default regex flag at line 46 of RegexRequestMatcher.java. This fix was authored by upstream maintainer Rob Winch on 2022-05-12 and was already present in the Spring Security 6.0.7 release before TuxCare onboarded it on 2026-09-14. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 describes an authorization bypass vulnerability in Spring Security's RegexRequestMatcher when using `.` in regex patterns. Without the Pattern.DOTALL flag, the `.` metacharacter does not match newline characters (\\n, \\r), allowing attackers to bypass regex-based authorization rules by injecting newlines into request paths (e.g., /admin%0a/sensitive bypassing /admin.* protection). The target repository (Spring Security 6.0.7-tuxcare.2) contains the fix: Pattern.DOTALL is set as the default regex flag at line 46 of RegexRequestMatcher.java. This fix was authored by upstream maintainer Rob Winch on 2022-05-12 and was already present in the Spring Security 6.0.7 release before TuxCare onboarded it on 2026-09-14. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. The target Spring Security 6.0.7 is not affected by CVE-2022-31692. The vulnerability involved AuthorizationFilter incorrectly extending OncePerRequestFilter, which caused authorization checks to be skipped on FORWARD and INCLUDE dispatcher types. The fix (commit 1f481aafff) changed the filter to extend GenericFilterBean with explicit dispatcher handling. This fix was already present in the upstream Spring Security 6.0.7 release that TuxCare onboarded, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "The target Spring Security 6.0.7 is not affected by CVE-2022-31692. The vulnerability involved AuthorizationFilter incorrectly extending OncePerRequestFilter, which caused authorization checks to be skipped on FORWARD and INCLUDE dispatcher types. The fix (commit 1f481aafff) changed the filter to extend GenericFilterBean with explicit dispatcher handling. This fix was already present in the upstream Spring Security 6.0.7 release that TuxCare onboarded, so the vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 is NOT present in Spring Security 6.0.7-tuxcare.2. The vulnerability (logout not properly cleaning serialized security contexts) was fixed in upstream Spring Security 6.0.3, and the target version 6.0.7 includes both required patches (commits 2d52fb8e and 8d664bc4). The fix was shipped in the upstream 6.0.7 release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 is NOT present in Spring Security 6.0.7-tuxcare.2. The vulnerability (logout not properly cleaning serialized security contexts) was fixed in upstream Spring Security 6.0.3, and the target version 6.0.7 includes both required patches (commits 2d52fb8e and 8d664bc4). The fix was shipped in the upstream 6.0.7 release that TuxCare onboarded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38810 affects the @AuthorizeReturnObject annotation in Spring Security 6.3.0 and 6.3.1. This annotation and its authorization infrastructure do not exist in version 6.0.7-tuxcare.2. The feature was introduced in commit d169d5a835 (by Josh Cummings), first appearing in version 6.2.5. Git history confirms this commit is NOT an ancestor of the target HEAD at 6.0.7. Comprehensive searches ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38810 affects the @AuthorizeReturnObject annotation in Spring Security 6.3.0 and 6.3.1. This annotation and its authorization infrastructure do not exist in version 6.0.7-tuxcare.2. The feature was introduced in commit d169d5a835 (by Josh Cummings), first appearing in version 6.2.5. Git history confirms this commit is NOT an ancestor of the target HEAD at 6.0.7. Comprehensive searches ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 6.0.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-hh3m-g4qj-4835 (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 6.0.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-hh3m-g4qj-4835 (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ..."
    }
  ]
}