{
  "@id": "urn:uuid:03ff3ff4-fe04-4287-a5f4-6db2a8afe3a4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 42,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:39:00.080138+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T21:01:09.226514+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 is NOT present in Spring Security 6.0.8. The vulnerability allowed bypassing security constraints via path parameters (semicolons in URLs). The upstream fix (SEC-1584, commit 7d97adc687) was already included in the Spring Security 6.0.8 release that TuxCare onboarded. The target has HttpFirewall infrastructure that protects against this attack: DefaultHttpFirewall strips path para...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 is NOT present in Spring Security 6.0.8. The vulnerability allowed bypassing security constraints via path parameters (semicolons in URLs). The upstream fix (SEC-1584, commit 7d97adc687) was already included in the Spring Security 6.0.8 release that TuxCare onboarded. The target has HttpFirewall infrastructure that protects against this attack: DefaultHttpFirewall strips path para..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T19:32:47.509416+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Target repository Spring Security 6.0.8 is NOT AFFECTED by CVE-2011-2731. The vulnerability (race condition in RunAsManager storing Authentication in shared SecurityContext) was fixed in upstream Spring Security by commits SEC-1750 and SEC-1967, authored by Spring developers luke.taylor@springsource.com and rwinch@vmware.com. These fixes were already present in the upstream 6.0.8 release that T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Target repository Spring Security 6.0.8 is NOT AFFECTED by CVE-2011-2731. The vulnerability (race condition in RunAsManager storing Authentication in shared SecurityContext) was fixed in upstream Spring Security by commits SEC-1750 and SEC-1967, authored by Spring developers luke.taylor@springsource.com and rwinch@vmware.com. These fixes were already present in the upstream 6.0.8 release that T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T23:11:48.225601+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.0.8 is NOT affected by CVE-2011-2732. Both security fixes from the vendor patches (CRLF validation in redirects and disabled spring-security-redirect parameter) were already present in the upstream Spring Security 6.0.8 release that TuxCare onboarded. The vulnerable code patterns do not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.8 is NOT affected by CVE-2011-2732. Both security fixes from the vendor patches (CRLF validation in redirects and disabled spring-security-redirect parameter) were already present in the upstream Spring Security 6.0.8 release that TuxCare onboarded. The vulnerable code patterns do not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T22:50:33.465860+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2011-2894. The vulnerable spring-security-remoting module, including the ContextPropagatingRemoteInvocation class that deserializes SecurityContext objects over RMI, was completely removed by upstream Spring Security in October 2021 (commit b2e6c60d94). This removal was first included in Spring Security 6.0.0, which predates version 6.0.8. The entire...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2011-2894. The vulnerable spring-security-remoting module, including the ContextPropagatingRemoteInvocation class that deserializes SecurityContext objects over RMI, was completely removed by upstream Spring Security in October 2021 (commit b2e6c60d94). This removal was first included in Spring Security 6.0.0, which predates version 6.0.8. The entire..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T21:18:38.890311+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.0.8 is NOT affected by CVE-2012-5055. The timing attack vulnerability was fixed in upstream Spring Security 3.1.3 (released in 2012) by commit c076f0f2e1, authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream 6.0.8 release that TuxCare onboarded. The vulnerable code pattern (skipping password validation when user not found) does not...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.0.8 is NOT affected by CVE-2012-5055. The timing attack vulnerability was fixed in upstream Spring Security 3.1.3 (released in 2012) by commit c076f0f2e1, authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream 6.0.8 release that TuxCare onboarded. The vulnerable code pattern (skipping password validation when user not found) does not..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T17:41:25.138372+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.8 does not contain CAS (Central Authentication Service) support. The entire CAS module, including all vulnerable code related to CVE-2014-3527, was removed from Spring Security in version 6.0 (upstream commit caf4c471053aa23f7c8dc2c2d484450f02657430, October 2021). The vulnerable classes DefaultServiceAuthenticationDetails.java and ServiceAuthenticationDetailsSource.java, which handled CAS proxy ticket authentication using untrusted HTTP request data, do not exist in this version. The CVE concerns host header injection in CAS authentication that allowed bypassing access control between CAS services, but the attack surface no longer exists.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "Spring Security 6.0.8 does not contain CAS (Central Authentication Service) support. The entire CAS module, including all vulnerable code related to CVE-2014-3527, was removed from Spring Security in version 6.0 (upstream commit caf4c471053aa23f7c8dc2c2d484450f02657430, October 2021). The vulnerable classes DefaultServiceAuthenticationDetails.java and ServiceAuthenticationDetailsSource.java, which handled CAS proxy ticket authentication using untrusted HTTP request data, do not exist in this version. The CVE concerns host header injection in CAS authentication that allowed bypassing access control between CAS services, but the attack surface no longer exists."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:35:45.229167+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.8 is not affected by CVE-2016-5007. The vulnerability affected versions 3.2.x, 4.0.x, and 4.1.0 where differences in URL pattern matching between Spring Security and Spring MVC allowed bypass attacks. The upstream project fixed this in 2016 by introducing MvcRequestMatcher (commit e4c13e3c0e) and URL-encoded slash blocking in DefaultHttpFirewall (commit 666e356ebc). Both fixes were already present in the upstream 6.0.8 release that TuxCare onboarded, as confirmed by git ancestry analysis showing these commits predating the first TuxCare commit (552dddff \"Onboard version 6.0.8\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 6.0.8 is not affected by CVE-2016-5007. The vulnerability affected versions 3.2.x, 4.0.x, and 4.1.0 where differences in URL pattern matching between Spring Security and Spring MVC allowed bypass attacks. The upstream project fixed this in 2016 by introducing MvcRequestMatcher (commit e4c13e3c0e) and URL-encoded slash blocking in DefaultHttpFirewall (commit 666e356ebc). Both fixes were already present in the upstream 6.0.8 release that TuxCare onboarded, as confirmed by git ancestry analysis showing these commits predating the first TuxCare commit (552dddff \"Onboard version 6.0.8\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:11:56.518932+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. The target Spring Security 6.0.8-tuxcare.5 is NOT affected by CVE-2016-9879. The fix for this vulnerability was included in upstream Spring Security versions 3.2.10, 4.1.4, and 4.2.1 (released December 2016). Version 6.0.8 (released June 2023) is much newer and already contains the upstream fix. The DefaultHttpFirewall.java class contains the complete defense: the containsInvalidUrlEncodedSlash() method checks for both %2f and %2F in requestURI and throws RequestRejectedException by default. No production code disables this protection (allowUrlEncodedSlash defaults to false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target Spring Security 6.0.8-tuxcare.5 is NOT affected by CVE-2016-9879. The fix for this vulnerability was included in upstream Spring Security versions 3.2.10, 4.1.4, and 4.2.1 (released December 2016). Version 6.0.8 (released June 2023) is much newer and already contains the upstream fix. The DefaultHttpFirewall.java class contains the complete defense: the containsInvalidUrlEncodedSlash() method checks for both %2f and %2F in requestURI and throws RequestRejectedException by default. No production code disables this protection (allowUrlEncodedSlash defaults to false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. The target Spring Security 6.0.8-tuxcare.5 is NOT AFFECTED by CVE-2017-4995. The vulnerability affected versions 4.2.0-4.2.2 and 5.0.0.M1. The fix (commit 5dee8534cd by Rob Winch, 2017-05-31) was already included in the upstream Spring Security 6.0.8 release that TuxCare onboarded. The current code implements the AllowlistTypeIdResolver defense that validates all class names during Jackson deserialization, preventing arbitrary code execution through deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "The target Spring Security 6.0.8-tuxcare.5 is NOT AFFECTED by CVE-2017-4995. The vulnerability affected versions 4.2.0-4.2.2 and 5.0.0.M1. The fix (commit 5dee8534cd by Rob Winch, 2017-05-31) was already included in the upstream Spring Security 6.0.8 release that TuxCare onboarded. The current code implements the AllowlistTypeIdResolver defense that validates all class names during Jackson deserialization, preventing arbitrary code execution through deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:47:24.883937+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 6.0.8. The vulnerability allowed attackers to bypass security constraints by adding URL path parameters with semicolons (e.g., /admin.html;x=user.html) to exploit servlet container inconsistencies in getPathInfo() handling. The upstream fix introduced StrictHttpFirewall which rejects requests containing semicolons (literal ';', '%3b', '%3B') and o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 6.0.8. The vulnerability allowed attackers to bypass security constraints by adding URL path parameters with semicolons (e.g., /admin.html;x=user.html) to exploit servlet container inconsistencies in getPathInfo() handling. The upstream fix introduced StrictHttpFirewall which rejects requests containing semicolons (literal ';', '%3b', '%3B') and o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2 due to JWT issuer validation using URL.equals() comparison, which can treat semantically different URLs as equivalent. The target Spring Security 6.0.8 is not affected because the fix (commit 19649db9ce) was already included in the upstream release. The current code compares issuers as Strings using String.equals(), eliminating the URL semantic equivalence vulnerability. This is an upstream fix authored by josh.cummings@gmail.com that shipped before TuxCare onboarded version 6.0.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2 due to JWT issuer validation using URL.equals() comparison, which can treat semantically different URLs as equivalent. The target Spring Security 6.0.8 is not affected because the fix (commit 19649db9ce) was already included in the upstream release. The current code compares issuers as Strings using String.equals(), eliminating the URL semantic equivalence vulnerability. This is an upstream fix authored by josh.cummings@gmail.com that shipped before TuxCare onboarded version 6.0.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.8 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class does not exist in this version. The class was removed by upstream Spring Security in version 5.0 (commit 12dbf2e961 by Rob Winch) as part of the migration to the new crypto API. The removal predates the TuxCare onboarding of version 6.0.8 (commit 552dddff), meaning the target repository never contained this vulnerability. The new crypto API uses the PasswordEncoder interface with a matches() method that employs null-safe equals() comparison, preventing the null-to-\"null\" string coercion issue that affected the legacy PlaintextPasswordEncoder.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 6.0.8 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class does not exist in this version. The class was removed by upstream Spring Security in version 5.0 (commit 12dbf2e961 by Rob Winch) as part of the migration to the new crypto API. The removal predates the TuxCare onboarding of version 6.0.8 (commit 552dddff), meaning the target repository never contained this vulnerability. The new crypto API uses the PasswordEncoder interface with a matches() method that employs null-safe equals() comparison, preventing the null-to-\"null\" string coercion issue that affected the legacy PlaintextPasswordEncoder.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T23:56:59.714304+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2019-3795. The vulnerability affects versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5. The fix was applied in March 2019 (commit 9c1eac79e2) by upstream author Josh Cummings, well before version 6.0.8 was released. The target repository contains the fixed version of SecureRandomFactoryBean where nextBytes() is c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2019-3795. The vulnerability affects versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5. The fix was applied in March 2019 (commit 9c1eac79e2) by upstream author Josh Cummings, well before version 6.0.8 was released. The target repository contains the fixed version of SecureRandomFactoryBean where nextBytes() is c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T18:39:00.080138+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 6.0.8 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 6.0.8 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T22:10:20.379436+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 The vulnerable queryableText() method described in CVE-2020-5408 has been completely removed from Spring Security in the target version 6.0.8. The fix was implemented by upstream maintainer Rob Winch (commit d996c2a2c6) and was already present in the upstream 6.0.8 release that TuxCare onboarded. While the underlying AesBytesEncryptor class still contains the 2-argument constructor that uses a ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 The vulnerable queryableText() method described in CVE-2020-5408 has been completely removed from Spring Security in the target version 6.0.8. The fix was implemented by upstream maintainer Rob Winch (commit d996c2a2c6) and was already present in the upstream 6.0.8 release that TuxCare onboarded. While the underlying AesBytesEncryptor class still contains the 2-argument constructor that uses a ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. The target Spring Security 6.0.8 repository is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unbounded accumulation of OAuth2 authorization requests in session storage) was fixed in upstream Spring Security commit 35f5ebdbcf (April 2021) and further improved in commit cae22867b2 (July 2022). Both fixes were already present in the upstream Spring Security 6.0.8 release when TuxCare onboarded it. The current implementation stores only one authorization request per session in both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target Spring Security 6.0.8 repository is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unbounded accumulation of OAuth2 authorization requests in session storage) was fixed in upstream Spring Security commit 35f5ebdbcf (April 2021) and further improved in commit cae22867b2 (July 2022). Both fixes were already present in the upstream Spring Security 6.0.8 release when TuxCare onboarded it. The current implementation stores only one authorization request per session in both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T05:12:00.099497+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 is not present in Spring Security 6.0.8. The integer overflow vulnerability in BCrypt.crypt_raw() has been fixed by upstream commit 3f13fa0285d1304d31b5963c134ed3fb4a8b49ba (Josh Cummings, June 17, 2021). The vulnerable pattern using `int rounds = 1 << log_rounds` has been replaced with `long rounds = roundsForLogRounds(log_rounds)` plus bounds validation, preventing overflow at ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 is not present in Spring Security 6.0.8. The integer overflow vulnerability in BCrypt.crypt_raw() has been fixed by upstream commit 3f13fa0285d1304d31b5963c134ed3fb4a8b49ba (Josh Cummings, June 17, 2021). The vulnerable pattern using `int rounds = 1 << log_rounds` has been replaced with `long rounds = roundsForLogRounds(log_rounds)` plus bounds validation, preventing overflow at ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. The target Spring Security 6.0.8 is not affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher not using Pattern.DOTALL flag, allowing newline characters to bypass regex-based authorization rules) was fixed in upstream Spring Security before the 6.0.0 release. The fix commit c6461d61ba by Rob Winch added Pattern.DOTALL to all regex compilations in RegexRequestMatcher. This fix was already present in the upstream 6.0.8 release that TuxCare onboarded (commit 552dddffd6), making the vulnerable code pattern absent from the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "The target Spring Security 6.0.8 is not affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher not using Pattern.DOTALL flag, allowing newline characters to bypass regex-based authorization rules) was fixed in upstream Spring Security before the 6.0.0 release. The fix commit c6461d61ba by Rob Winch added Pattern.DOTALL to all regex compilations in RegexRequestMatcher. This fix was already present in the upstream 6.0.8 release that TuxCare onboarded (commit 552dddffd6), making the vulnerable code pattern absent from the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. CVE-2022-31692 is not present in Spring Security 6.0.8. The vulnerability required AuthorizationFilter to extend OncePerRequestFilter, which automatically skips FORWARD and INCLUDE dispatcher types, preventing authorization checks on those requests. The target extends GenericFilterBean instead and has explicit dispatcher-type handling that does NOT skip FORWARD/INCLUDE. The fix (commit 1f481aafff14f324ffe2b43a973d3d5f54ae92d4, dated Oct 26, 2022) was authored by upstream Spring Security developers and was already included in the 6.0.8 upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 is not present in Spring Security 6.0.8. The vulnerability required AuthorizationFilter to extend OncePerRequestFilter, which automatically skips FORWARD and INCLUDE dispatcher types, preventing authorization checks on those requests. The target extends GenericFilterBean instead and has explicit dispatcher-type handling that does NOT skip FORWARD/INCLUDE. The fix (commit 1f481aafff14f324ffe2b43a973d3d5f54ae92d4, dated Oct 26, 2022) was authored by upstream Spring Security developers and was already included in the 6.0.8 upstream release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T22:43:54.379537+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 is NOT present in the target. The vulnerability (logout not clearing serialized security context) was fixed in upstream Spring Security 6.0.8 before TuxCare onboarded it. All fix components are present: SecurityContextLogoutHandler saves empty context on logout (line 84), HttpSessionSecurityContextRepository removes session attribute for empty contexts (lines 158-172), Delegating...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 is NOT present in the target. The vulnerability (logout not clearing serialized security context) was fixed in upstream Spring Security 6.0.8 before TuxCare onboarded it. All fix components are present: SecurityContextLogoutHandler saves empty context on logout (line 84), HttpSessionSecurityContextRepository removes session attribute for empty contexts (lines 158-172), Delegating..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T14:20:18.274403+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:52:51.215173+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2024-38810. The vulnerability requires the @AuthorizeReturnObject annotation, which was introduced in version 6.2.5 (commit d169d5a835, dated 2024-03-15). Version 6.0.8 predates this feature by approximately one year. Exhaustive search of the codebase confirms zero occurrences of AuthorizeReturnObject. The MethodSecurityAdvisorRegistrar in 6.0.8 only...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2024-38810. The vulnerability requires the @AuthorizeReturnObject annotation, which was introduced in version 6.2.5 (commit d169d5a835, dated 2024-03-15). Version 6.0.8 predates this feature by approximately one year. Exhaustive search of the codebase confirms zero occurrences of AuthorizeReturnObject. The MethodSecurityAdvisorRegistrar in 6.0.8 only..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T14:21:42.171880+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T20:13:00.134821+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core, and is fixed in 6.0.8-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "action_statement": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core, and is fixed in 6.0.8-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T14:20:18.274403+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T10:49:55.998641+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T18:34:10.986929+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "action_statement": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T14:20:18.274403+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T06:03:59.210364+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T14:21:42.171880+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.0.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th..."
    }
  ]
}