{
  "@id": "urn:uuid:4f9239d5-ac35-4904-b155-32ce9ff225b1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T03:04:00.156680+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (semicolon-delimited segments like \";param=value\" in URLs). The target is Spring Security 6.1.5-tuxcare.2, which contains the complete SEC-1584 fix from October 2010. The HttpFirewall infrastructure strips path parameters from servletPath and pathInf...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (semicolon-delimited segments like \";param=value\" in URLs). The target is Spring Security 6.1.5-tuxcare.2, which contains the complete SEC-1584 fix from October 2010. The HttpFirewall infrastructure strips path parameters from servletPath and pathInf..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6 (released 2011). The target is Spring Security 6.1.5 (released 2023), which contains upstream fixes SEC-1750 and SEC-1967 from 2011-2012. The vulnerable pattern (storing RunAs Authentication in shared SecurityContext) is not present: the code creates isolated SecurityContext instances for each thread's RunAs auth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6 (released 2011). The target is Spring Security 6.1.5 (released 2023), which contains upstream fixes SEC-1750 and SEC-1967 from 2011-2012. The vulnerable pattern (storing RunAs Authentication in shared SecurityContext) is not present: the code creates isolated SecurityContext instances for each thread's RunAs auth..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 describes CRLF injection in Spring Security's logout functionality via the spring-security-redirect parameter. The target version 6.1.5 is NOT AFFECTED because the upstream vendor (Spring Security) fixed this vulnerability in 2011, and the fix was already present in the 6.1.5 release that TuxCare onboarded. The defense includes: (1) CRLF validation in FirewalledResponse.sendRedire...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 describes CRLF injection in Spring Security's logout functionality via the spring-security-redirect parameter. The target version 6.1.5 is NOT AFFECTED because the upstream vendor (Spring Security) fixed this vulnerability in 2011, and the fix was already present in the 6.1.5 release that TuxCare onboarded. The defense includes: (1) CRLF validation in FirewalledResponse.sendRedire..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.5 is not affected by CVE-2011-2894. The vulnerable RMI remoting module (containing ContextPropagatingRemoteInvocation) was completely removed by upstream Spring Security in October 2021 (commit b2e6c60d94). This removal was part of the upstream 6.1.5 release that TuxCare onboarded. The target does not receive or process serialized Java objects from RMI clients, eliminating t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.5 is not affected by CVE-2011-2894. The vulnerable RMI remoting module (containing ContextPropagatingRemoteInvocation) was completely removed by upstream Spring Security in October 2021 (commit b2e6c60d94). This removal was part of the upstream 6.1.5 release that TuxCare onboarded. The target does not receive or process serialized Java objects from RMI clients, eliminating t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.5-tuxcare.2 is not affected by CVE-2012-5055. The timing-based username enumeration vulnerability in DaoAuthenticationProvider was fixed by upstream Spring Security in October 2012 (commit c076f0f2e1). The fix adds timing attack protection by performing dummy password encoding when a user is not found, preventing attackers from distinguishing between existing and non-existin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.5-tuxcare.2 is not affected by CVE-2012-5055. The timing-based username enumeration vulnerability in DaoAuthenticationProvider was fixed by upstream Spring Security in October 2012 (commit c076f0f2e1). The fix adds timing attack protection by performing dummy password encoding when a user is not found, preventing attackers from distinguishing between existing and non-existin..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2014-3527 is NOT present in Spring Security 6.1.5-tuxcare.2. The vulnerability allowed attackers to manipulate HTTP Host headers to trick CAS proxy ticket authentication into accepting requests with false service identity, bypassing service-to-service access controls. The fix (commit 934937d9c1, authored by Rob Winch) was already present in the upstream Spring Security 6.1.5 release before TuxCare onboarded it. The code now derives service identity from trusted ServiceProperties configuration instead of untrusted HTTP request headers.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 is NOT present in Spring Security 6.1.5-tuxcare.2. The vulnerability allowed attackers to manipulate HTTP Host headers to trick CAS proxy ticket authentication into accepting requests with false service identity, bypassing service-to-service access controls. The fix (commit 934937d9c1, authored by Rob Winch) was already present in the upstream Spring Security 6.1.5 release before TuxCare onboarded it. The code now derives service identity from trusted ServiceProperties configuration instead of untrusted HTTP request headers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.1.5 is not affected by CVE-2016-5007. The vulnerability concerned pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass. Both defenses from the vendor patches are present in the target: (1) DefaultHttpFirewall blocks URL-encoded slashes (%2f/%2F) in requestURI at lines 60-61, 86-93, and (2) MvcRequestMatcher uses HandlerMappingIntrospector to align Spring Security's pattern matching with Spring MVC's routing rules. These fixes were introduced by upstream Spring Security (commits 666e356ebc479194ba51e43bb99fc42f849b6175 and e4c13e3c0ee7f06f59d3b43ca6734215ad7d8974) in 2016, long before the target version 6.1.5 was released in 2023. The fixes are ancestors of the TuxCare onboarding commit, confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Security 6.1.5 is not affected by CVE-2016-5007. The vulnerability concerned pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass. Both defenses from the vendor patches are present in the target: (1) DefaultHttpFirewall blocks URL-encoded slashes (%2f/%2F) in requestURI at lines 60-61, 86-93, and (2) MvcRequestMatcher uses HandlerMappingIntrospector to align Spring Security's pattern matching with Spring MVC's routing rules. These fixes were introduced by upstream Spring Security (commits 666e356ebc479194ba51e43bb99fc42f849b6175 and e4c13e3c0ee7f06f59d3b43ca6734215ad7d8974) in 2016, long before the target version 6.1.5 was released in 2023. The fixes are ancestors of the TuxCare onboarding commit, confirming they shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2016-9879 affects Spring Security versions 3.2.0-3.2.9, 4.0.x-4.1.3, and 4.2.0. The target repository is Spring Security 6.1.5-tuxcare.2, which already contains the upstream fix for this vulnerability. The fix (commit 666e356ebc) was authored by upstream developer Rob Winch and shipped in the Spring Security 6.1.5 release before TuxCare onboarded it. The vulnerable code pattern (accepting URL-encoded slashes without validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "CVE-2016-9879 affects Spring Security versions 3.2.0-3.2.9, 4.0.x-4.1.3, and 4.2.0. The target repository is Spring Security 6.1.5-tuxcare.2, which already contains the upstream fix for this vulnerability. The fix (commit 666e356ebc) was authored by upstream developer Rob Winch and shipped in the Spring Security 6.1.5 release before TuxCare onboarded it. The vulnerable code pattern (accepting URL-encoded slashes without validation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.1.5 at the target SHA d58dad69ea is NOT AFFECTED by CVE-2017-4995. The vulnerable pattern (unrestricted Jackson default typing allowing arbitrary deserialization gadgets) does not exist in this version. The upstream fix (commit 5dee8534cd by Rob Winch) was already included in the Spring Security 6.1.5 release that TuxCare onboarded. The target code contains the complete defense mechanism: AllowlistTypeIdResolver enforces a three-part validation (allowlist check + explicit mixin check + Jackson annotation check) on every type resolution during deserialization, blocking unknown classes from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 6.1.5 at the target SHA d58dad69ea is NOT AFFECTED by CVE-2017-4995. The vulnerable pattern (unrestricted Jackson default typing allowing arbitrary deserialization gadgets) does not exist in this version. The upstream fix (commit 5dee8534cd by Rob Winch) was already included in the Spring Security 6.1.5 release that TuxCare onboarded. The target code contains the complete defense mechanism: AllowlistTypeIdResolver enforces a three-part validation (allowlist check + explicit mixin check + Jackson annotation check) on every type resolution during deserialization, blocking unknown classes from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.5-tuxcare.2 is NOT affected by CVE-2018-1199. The vulnerability, which allowed bypassing security constraints via URL path parameters with special encodings (semicolons, encoded slashes, etc.), has been fixed in the upstream release. The fix (StrictHttpFirewall) was introduced in upstream commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 by Rob Winch and was already present in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.5-tuxcare.2 is NOT affected by CVE-2018-1199. The vulnerability, which allowed bypassing security constraints via URL path parameters with special encodings (semicolons, encoded slashes, etc.), has been fixed in the upstream release. The fix (StrictHttpFirewall) was introduced in upstream commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 by Rob Winch and was already present in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. The target Spring Security 6.1.5 does not contain CVE-2018-15801. The vulnerable pattern (URL.equals() comparison during JWT issuer validation) was fixed in upstream commit 19649db9ce by Josh Cummings, which shipped in the 6.1.5 release before TuxCare onboarding. The current implementation uses String.equals() comparison via a Predicate that compares issuer.equals(claimValue.toString()), preventing the issuer validation bypass vulnerability. The MappedJwtClaimSetConverter.convertIssuer() method ensures issuer claims are normalized to Strings using URL.toExternalForm() when needed. This eliminates the URL.equals() quirks that allowed malicious issuer URLs to be incorrectly accepted as matching honest issuer URLs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "The target Spring Security 6.1.5 does not contain CVE-2018-15801. The vulnerable pattern (URL.equals() comparison during JWT issuer validation) was fixed in upstream commit 19649db9ce by Josh Cummings, which shipped in the 6.1.5 release before TuxCare onboarding. The current implementation uses String.equals() comparison via a Predicate that compares issuer.equals(claimValue.toString()), preventing the issuer validation bypass vulnerability. The MappedJwtClaimSetConverter.convertIssuer() method ensures issuer claims are normalized to Strings using URL.toExternalForm() when needed. This eliminates the URL.equals() quirks that allowed malicious issuer URLs to be incorrectly accepted as matching honest issuer URLs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.1.5 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0.0 RC1 (October 2017, commit 12dbf2e961), well before version 6.1.5 was released. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions that still contained PlaintextPasswordEncoder. Modern Spring Security 6.x uses cryptographic password encoders (BCrypt, PBKDF2, SCrypt, Argon2) in the crypto module with a different API (matches() instead of isPasswordValid()), and these do not have the null password vulnerability. The removal was done by upstream Spring Security, not TuxCare, and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 6.1.5 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0.0 RC1 (October 2017, commit 12dbf2e961), well before version 6.1.5 was released. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions that still contained PlaintextPasswordEncoder. Modern Spring Security 6.x uses cryptographic password encoders (BCrypt, PBKDF2, SCrypt, Argon2) in the crypto module with a different API (matches() instead of isPasswordValid()), and these do not have the null password vulnerability. The removal was done by upstream Spring Security, not TuxCare, and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 addresses an insecure randomness vulnerability in Spring Security's SecureRandomFactoryBean where user-provided seeds could completely replace the SecureRandom's internal state, making output predictable. The target repository (Spring Security 6.1.5-tuxcare.2) is NOT affected because the vulnerability was fixed by upstream Spring Security in March 2019 (commit 9c1eac79e2abb50f7b01...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 addresses an insecure randomness vulnerability in Spring Security's SecureRandomFactoryBean where user-provided seeds could completely replace the SecureRandom's internal state, making output predictable. The target repository (Spring Security 6.1.5-tuxcare.2) is NOT affected because the vulnerability was fixed by upstream Spring Security in March 2019 (commit 9c1eac79e2abb50f7b01..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 affects Spring Security's queryableText() encryptor which used a fixed null initialization vector with CBC mode, enabling dictionary attacks. Version 6.1.5 is not affected because the vulnerable queryableText() method was completely removed from the codebase in upstream Spring Security. The removal occurred in commit d996c2a2c6 (Sept 2022) by Rob Winch, which was already part of t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects Spring Security's queryableText() encryptor which used a fixed null initialization vector with CBC mode, enabling dictionary attacks. Version 6.1.5 is not affected because the vulnerable queryableText() method was completely removed from the codebase in upstream Spring Security. The removal occurred in commit d996c2a2c6 (Sept 2022) by Rob Winch, which was already part of t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. The target version 6.1.5 is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unlimited OAuth2 authorization request accumulation in session storage) was fixed in upstream Spring Security and shipped in the 6.1.5 release that TuxCare onboarded. Both Servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store authorization requests as single objects, not in unbounded Maps. The fix commit 35f5ebdbcf is an ancestor of HEAD and predates the TuxCare onboarding commit 1ee981b61c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target version 6.1.5 is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unlimited OAuth2 authorization request accumulation in session storage) was fixed in upstream Spring Security and shipped in the 6.1.5 release that TuxCare onboarded. Both Servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store authorization requests as single objects, not in unbounded Maps. The fix commit 35f5ebdbcf is an ancestor of HEAD and predates the TuxCare onboarding commit 1ee981b61c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 describes an integer overflow vulnerability in Spring Security's BCrypt implementation when using the maximum work factor (31). The vulnerable pattern `rounds = 1 << log_rounds` with int arithmetic causes integer overflow, resulting in zero salt rounds being executed. This vulnerability is NOT present in the target repository (Spring Security 6.1.5-tuxcare.2) because the fix was ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 describes an integer overflow vulnerability in Spring Security's BCrypt implementation when using the maximum work factor (31). The vulnerable pattern `rounds = 1 << log_rounds` with int arithmetic causes integer overflow, resulting in zero salt rounds being executed. This vulnerability is NOT present in the target repository (Spring Security 6.1.5-tuxcare.2) because the fix was ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 6.1.5 is NOT affected by CVE-2022-22978. The vulnerability involved RegexRequestMatcher being bypassable via HTTP request paths containing line terminators (\\n or \\r) because the `.` metacharacter in regex patterns did not match these characters without the Pattern.DOTALL flag. The fix (adding Pattern.DOTALL to all regex compilation in RegexRequestMatcher) was already present in the upstream Spring Security 6.1.5 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "Spring Security 6.1.5 is NOT affected by CVE-2022-22978. The vulnerability involved RegexRequestMatcher being bypassable via HTTP request paths containing line terminators (\\n or \\r) because the `.` metacharacter in regex patterns did not match these characters without the Pattern.DOTALL flag. The fix (adding Pattern.DOTALL to all regex compilation in RegexRequestMatcher) was already present in the upstream Spring Security 6.1.5 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. CVE-2022-31692 is not present in Spring Security 6.1.5-tuxcare.2. The vulnerability (authorization bypass via FORWARD/INCLUDE dispatcher types) was fixed in upstream commit 1f481aafff by Marcus Da Coregio, which changed AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean with explicit dispatcher type handling. This fix shipped in upstream release 6.1.5 before TuxCare onboarded it (first TuxCare commit 1ee981b61c). The vulnerable code pattern is completely absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 is not present in Spring Security 6.1.5-tuxcare.2. The vulnerability (authorization bypass via FORWARD/INCLUDE dispatcher types) was fixed in upstream commit 1f481aafff by Marcus Da Coregio, which changed AuthorizationFilter from extending OncePerRequestFilter to GenericFilterBean with explicit dispatcher type handling. This fix shipped in upstream release 6.1.5 before TuxCare onboarded it (first TuxCare commit 1ee981b61c). The vulnerable code pattern is completely absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Target version 6.1.5-tuxcare.2 is NOT affected by CVE-2023-20862. The vulnerability was fixed by the upstream Spring Security project in commits 8d664bc4c2 (DelegatingSecurityContextRepository fix) and 2d52fb8e4b (logout handler fix), both of which were included in the upstream 6.1.5 release before TuxCare onboarded it. All three defense mechanisms are present: (1) SecurityContextLogoutHandler ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 Target version 6.1.5-tuxcare.2 is NOT affected by CVE-2023-20862. The vulnerability was fixed by the upstream Spring Security project in commits 8d664bc4c2 (DelegatingSecurityContextRepository fix) and 2d52fb8e4b (logout handler fix), both of which were included in the upstream 6.1.5 release before TuxCare onboarded it. All three defense mechanisms are present: (1) SecurityContextLogoutHandler ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.5 is not affected by CVE-2024-38810. The vulnerability requires the @AuthorizeReturnObject annotation and associated AuthorizationProxyConfiguration infrastructure, which were first introduced in version 6.2.5 (commit d169d5a835). The target version 6.1.5 predates this feature entirely. While the target does contain a bean-copying pattern in MethodSecurityAdvisorRegistrar th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.5 is not affected by CVE-2024-38810. The vulnerability requires the @AuthorizeReturnObject annotation and associated AuthorizationProxyConfiguration infrastructure, which were first introduced in version 6.2.5 (commit d169d5a835). The target version 6.1.5 predates this feature entirely. While the target does contain a bean-copying pattern in MethodSecurityAdvisorRegistrar th..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:04:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:04:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2025-22234 is a regression vulnerability that only affects systems with the broken CVE-2025-22228 fix (password length check without the `!for_check` condition). The target spring-security 6.1.5-tuxcare.2 (SHA d58dad69ea) does not have the CVE-2025-22228 fix at all \u2014 no password length check exists in BCrypt.java. Since the vulnerable code pattern (the broken fix that causes timing attack r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 is a regression vulnerability that only affects systems with the broken CVE-2025-22228 fix (password length check without the `!for_check` condition). The target spring-security 6.1.5-tuxcare.2 (SHA d58dad69ea) does not have the CVE-2025-22228 fix at all \u2014 no password length check exists in BCrypt.java. Since the vulnerable code pattern (the broken fix that causes timing attack r..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "action_statement": "Vulnerability CVE-2025-41232 affects version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 6.1.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8v5q-rhf3-jphm (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 6.1.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8v5q-rhf3-jphm (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:04:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.1.5-tuxcare.2 is NOT affected by CVE-2026-22751 because the vulnerable OneTimeToken authentication feature (including JdbcOneTimeTokenService) was not introduced until version 6.4.0. The target version predates the vulnerable component by three minor versions. Exhaustive searches confirmed no OneTimeToken code exists in the target tree, and git ancestry verification shows the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.1.5-tuxcare.2 is NOT affected by CVE-2026-22751 because the vulnerable OneTimeToken authentication feature (including JdbcOneTimeTokenService) was not introduced until version 6.4.0. The target version predates the vulnerable component by three minor versions. Exhaustive searches confirmed no OneTimeToken code exists in the target tree, and git ancestry verification shows the ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:04:00.156680+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T03:03:20.129700+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Target version 6.1.5 (released October 2023) does not contain the InetAddressMatchers utility class, which was introduced to Spring Security in March 2026. The vulnerable code pattern\u2014specifically the matchInternal() and matchExternal() methods that misclassify \"any local\" addresses (0.0.0.0 and ::)\u2014does not exist in this version. Exhaustive search confirms no InetAddressMatchers class, no matc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Target version 6.1.5 (released October 2023) does not contain the InetAddressMatchers utility class, which was introduced to Spring Security in March 2026. The vulnerable code pattern\u2014specifically the matchInternal() and matchExternal() methods that misclassify \"any local\" addresses (0.0.0.0 and ::)\u2014does not exist in this version. Exhaustive search confirms no InetAddressMatchers class, no matc..."
    }
  ]
}