{
  "@id": "urn:uuid:36649355-b12f-44c8-8cd6-fb4cc6d60922",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 46,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:39:00.080138+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T20:57:39.334641+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4. The target version 6.2.2 contains the upstream fix introduced in October 2010 by commit 7d97adc687. The fix adds HttpFirewall infrastructure that wraps all incoming requests before security pattern matching. By default, StrictHttpFirewall rejects URLs containing semicolons entirely (protecting against path parameter by...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4. The target version 6.2.2 contains the upstream fix introduced in October 2010 by commit 7d97adc687. The fix adds HttpFirewall infrastructure that wraps all incoming requests before security pattern matching. By default, StrictHttpFirewall rejects URLs containing semicolons entirely (protecting against path parameter by..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T19:27:56.776788+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target repository is Spring Security 6.2.2, which already contains the upstream fix (SEC-1750) authored by Luke Taylor in 2011. The vulnerable pattern (storing Authentication in a shared SecurityContext during RunAsManager operations) is not present. The fix creates an isolated SecurityContext for RunAs auth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target repository is Spring Security 6.2.2, which already contains the upstream fix (SEC-1750) authored by Luke Taylor in 2011. The vulnerable pattern (storing Authentication in a shared SecurityContext during RunAsManager operations) is not present. The fix creates an isolated SecurityContext for RunAs auth..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T23:07:50.060197+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2011-2732 (CRLF injection in logout redirect). The vulnerability pattern is not present because the upstream vendor fix was already shipped in Spring Security 6.2.2. The target implements comprehensive CRLF validation through FirewalledResponse, which intercepts all sendRedirect() calls and rejects any location containing CR or LF characters. This de...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2011-2732 (CRLF injection in logout redirect). The vulnerability pattern is not present because the upstream vendor fix was already shipped in Spring Security 6.2.2. The target implements comprehensive CRLF validation through FirewalledResponse, which intercepts all sendRedirect() calls and rejects any location containing CR or LF characters. This de..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T22:46:16.879594+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2011-2894. The vulnerable RMI remoting module (including ContextPropagatingRemoteInvocation class that deserializes untrusted SecurityContext objects) was completely removed from Spring Security in October 2021 by upstream author Marcus Da Coregio (commit b2e6c60d94), approximately 2.5 years before the 6.2.2 release. The entire org.springframework.se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2011-2894. The vulnerable RMI remoting module (including ContextPropagatingRemoteInvocation class that deserializes untrusted SecurityContext objects) was completely removed from Spring Security in October 2021 by upstream author Marcus Da Coregio (commit b2e6c60d94), approximately 2.5 years before the 6.2.2 release. The entire org.springframework.se..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T21:15:17.463976+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.2.2-tuxcare.9 is NOT AFFECTED by CVE-2012-5055. The timing attack vulnerability pattern is not present because the SEC-2056 mitigation was already included in the upstream Spring Security release. The fix (commit c076f0f2e1 by rwinch@vmware.com, dated 2012-10-07) predates the first TuxCare commit (3d7b2f33cb by npinsker@cloudlinux.com, dated 2026-04-03), confirming ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.2.2-tuxcare.9 is NOT AFFECTED by CVE-2012-5055. The timing attack vulnerability pattern is not present because the SEC-2056 mitigation was already included in the upstream Spring Security release. The fix (commit c076f0f2e1 by rwinch@vmware.com, dated 2012-10-07) predates the first TuxCare commit (3d7b2f33cb by npinsker@cloudlinux.com, dated 2026-04-03), confirming ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T17:39:29.193756+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. CVE-2014-3527 (CAS Proxy Ticket Authentication vulnerability) is not present in Spring Security 6.2.2. The vulnerability affected versions through 3.2.4 and 3.1.6, and was fixed in August 2014 by upstream commit 934937d9c1. The fix was already included in the upstream Spring Security 6.2.2 release that TuxCare onboarded in April 2026. The target code uses the secure implementation that extracts scheme/host/port from the configured ServiceProperties rather than from untrusted HttpServletRequest headers.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 (CAS Proxy Ticket Authentication vulnerability) is not present in Spring Security 6.2.2. The vulnerability affected versions through 3.2.4 and 3.1.6, and was fixed in August 2014 by upstream commit 934937d9c1. The fix was already included in the upstream Spring Security 6.2.2 release that TuxCare onboarded in April 2026. The target code uses the secure implementation that extracts scheme/host/port from the configured ServiceProperties rather than from untrusted HttpServletRequest headers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T12:33:19.742472+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. CVE-2016-5007 is NOT present in Spring Security 6.2.2. Both required fixes (MvcRequestMatcher for aligned URL matching and DefaultHttpFirewall's encoded-slash blocking) were introduced by upstream vendor Rob Winch in 2016 and shipped in Spring Security 4.1.1/4.2.1. The target version 6.2.2 (released February 2024) is 8 years newer and includes both defenses. TuxCare onboarded version 6.2.2 in April 2026, inheriting these upstream fixes. The vulnerable pattern (URL matching discrepancies allowing authorization bypass) cannot exist in the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Security 6.2.2. Both required fixes (MvcRequestMatcher for aligned URL matching and DefaultHttpFirewall's encoded-slash blocking) were introduced by upstream vendor Rob Winch in 2016 and shipped in Spring Security 4.1.1/4.2.1. The target version 6.2.2 (released February 2024) is 8 years newer and includes both defenses. TuxCare onboarded version 6.2.2 in April 2026, inheriting these upstream fixes. The vulnerable pattern (URL matching discrepancies allowing authorization bypass) cannot exist in the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. Spring Security 6.2.2 is not affected by CVE-2016-9879. The vulnerability concerns URL-encoded slashes in path parameters bypassing security constraints in versions 3.2.0-3.2.9, 4.0.x-4.1.3, and 4.2.0. The fix was introduced by upstream Spring Security in December 2016 (commit 666e356ebc) and is present in version 6.2.2. The DefaultHttpFirewall.java class contains the complete mitigation: it checks for encoded slashes (%2f or %2F) in request URIs and throws RequestRejectedException when detected (lines 59-62). Additionally, Spring Security 6.2.2 includes StrictHttpFirewall, an even more restrictive implementation that also blocks encoded slashes. Both protections are enabled by default. This is an upstream fix that shipped in the Spring Security 6.2.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Spring Security 6.2.2 is not affected by CVE-2016-9879. The vulnerability concerns URL-encoded slashes in path parameters bypassing security constraints in versions 3.2.0-3.2.9, 4.0.x-4.1.3, and 4.2.0. The fix was introduced by upstream Spring Security in December 2016 (commit 666e356ebc) and is present in version 6.2.2. The DefaultHttpFirewall.java class contains the complete mitigation: it checks for encoded slashes (%2f or %2F) in request URIs and throws RequestRejectedException when detected (lines 59-62). Additionally, Spring Security 6.2.2 includes StrictHttpFirewall, an even more restrictive implementation that also blocks encoded slashes. Both protections are enabled by default. This is an upstream fix that shipped in the Spring Security 6.2.2 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. Spring Security 6.2.2 is NOT affected by CVE-2017-4995. The target repository contains the upstream vendor's fix (commit 5dee8534cd by Rob Winch, Spring Security team) which was already present in the upstream 6.2.2 release when TuxCare onboarded it. The fix introduced whitelist-based type validation in SecurityJackson2Modules.java that blocks unsafe deserialization of arbitrary classes. The vulnerable pattern (unrestricted default typing) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Spring Security 6.2.2 is NOT affected by CVE-2017-4995. The target repository contains the upstream vendor's fix (commit 5dee8534cd by Rob Winch, Spring Security team) which was already present in the upstream 6.2.2 release when TuxCare onboarded it. The fix introduced whitelist-based type validation in SecurityJackson2Modules.java that blocks unsafe deserialization of arbitrary classes. The vulnerable pattern (unrestricted default typing) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:30.480251+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Security 6.2.2. The vulnerability involves bypassing security constraints using URL path parameters (semicolons) with special encodings. The upstream fix (commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 by Rob Winch) introduced StrictHttpFirewall that rejects semicolons by default, preventing path parameter attacks. This fix was already present in the upst...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Security 6.2.2. The vulnerability involves bypassing security constraints using URL path parameters (semicolons) with special encodings. The upstream fix (commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2 by Rob Winch) introduced StrictHttpFirewall that rejects semicolons by default, preventing path parameter attacks. This fix was already present in the upst..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. Spring Security 6.2.2 is NOT affected by CVE-2018-15801. The vulnerability was fixed in upstream Spring Security 5.1.2 (November 2018) via commit 19649db9ce, which changed JWT issuer validation from problematic URL.equals() comparison to String-based comparison. The target version 6.2.2 (released years later) inherited this fix from upstream. Both JwtIssuerValidator and MappedJwtClaimSetConverter contain the defensive code that prevents issuer mismatch via URL comparison semantics.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "Spring Security 6.2.2 is NOT affected by CVE-2018-15801. The vulnerability was fixed in upstream Spring Security 5.1.2 (November 2018) via commit 19649db9ce, which changed JWT issuer validation from problematic URL.equals() comparison to String-based comparison. The target version 6.2.2 (released years later) inherited this fix from upstream. Both JwtIssuerValidator and MappedJwtClaimSetConverter contain the defensive code that prevents issuer mismatch via URL comparison semantics.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. Spring Security 6.2.2 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0.RC1 (October 2017) via commit 12dbf2e961, years before version 6.2.2 was released. The removal was an upstream change by Rob Winch and was included in the upstream release that TuxCare onboarded. The modern replacement NoOpPasswordEncoder uses .equals() for password comparison, which correctly returns false when comparing against null, and does not exhibit the vulnerable null-to-string-\"null\" conversion behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 6.2.2 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0.RC1 (October 2017) via commit 12dbf2e961, years before version 6.2.2 was released. The removal was an upstream change by Rob Winch and was included in the upstream release that TuxCare onboarded. The modern replacement NoOpPasswordEncoder uses .equals() for password comparison, which correctly returns false when comparing against null, and does not exhibit the vulnerable null-to-string-\"null\" conversion behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T23:56:10.637829+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5, concerning insecure randomness when using SecureRandomFactoryBean#setSeed. The target version 6.2.2-tuxcare.9 is NOT affected because the upstream Spring Security project already fixed this vulnerability in March 2019 (commit 9c1eac79e2), and this fix was included in the upstre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 affects Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5, concerning insecure randomness when using SecureRandomFactoryBean#setSeed. The target version 6.2.2-tuxcare.9 is NOT affected because the upstream Spring Security project already fixed this vulnerability in March 2019 (commit 9c1eac79e2), and this fix was included in the upstre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-06T18:39:00.080138+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 6.2.2 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0db9cd07, 1fcac58c, 3ed31400). Version 6.2.2 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T22:06:58.799510+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2020-5408 affects Spring Security versions prior to 5.3.2, 5.2.4, 5.1.10, 5.0.16, and 4.2.16 due to use of a fixed null initialization vector with CBC mode in the queryableText() encryptor method. The target version 6.2.2 is NOT affected because the vulnerable queryableText() method was completely removed by upstream commit d996c2a2c6d14c4e578cb56019737922060fd7da (authored by Rob Winch on ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects Spring Security versions prior to 5.3.2, 5.2.4, 5.1.10, 5.0.16, and 4.2.16 due to use of a fixed null initialization vector with CBC mode in the queryableText() encryptor method. The target version 6.2.2 is NOT affected because the vulnerable queryableText() method was completely removed by upstream commit d996c2a2c6d14c4e578cb56019737922060fd7da (authored by Rob Winch on ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. CVE-2021-22119 describes a DoS vulnerability where attackers could exhaust system resources by sending multiple OAuth2 authorization requests that accumulate unboundedly in session storage. The target Spring Security 6.2.2 is NOT affected because the upstream fix was already present in the release that TuxCare onboarded. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store only ONE authorization request per session, overwriting previous requests instead of accumulating them in a Map. The vulnerable code pattern (unbounded Map accumulation) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 describes a DoS vulnerability where attackers could exhaust system resources by sending multiple OAuth2 authorization requests that accumulate unboundedly in session storage. The target Spring Security 6.2.2 is NOT affected because the upstream fix was already present in the release that TuxCare onboarded. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store only ONE authorization request per session, overwriting previous requests instead of accumulating them in a Map. The vulnerable code pattern (unbounded Map accumulation) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T05:12:00.099497+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 (BCrypt integer overflow) is not present in the target. The vulnerability involved integer overflow when computing salt rounds with work factor 31, causing the bit-shift operation `1 << 31` to produce a negative int value, resulting in zero salt rounds being applied. The upstream fix (commit e6297d3bf7 by Josh Cummings) was already present in Spring Security 6.2.2 before TuxCare'...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22976 (BCrypt integer overflow) is not present in the target. The vulnerability involved integer overflow when computing salt rounds with work factor 31, causing the bit-shift operation `1 << 31` to produce a negative int value, resulting in zero salt rounds being applied. The upstream fix (commit e6297d3bf7 by Josh Cummings) was already present in Spring Security 6.2.2 before TuxCare'..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. CVE-2022-22978 is NOT present in Spring Security 6.2.2-tuxcare.9. The vulnerability (RegexRequestMatcher bypass via line terminators) was fixed in the upstream release by enabling Pattern.DOTALL flag. The target code has DEFAULT = Pattern.DOTALL (line 46), ensuring the '.' metacharacter matches newlines and carriage returns, preventing authorization bypass. This is an upstream fix by Rob Winch that shipped in Spring Security 6.2.2 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 is NOT present in Spring Security 6.2.2-tuxcare.9. The vulnerability (RegexRequestMatcher bypass via line terminators) was fixed in the upstream release by enabling Pattern.DOTALL flag. The target code has DEFAULT = Pattern.DOTALL (line 46), ensuring the '.' metacharacter matches newlines and carriage returns, preventing authorization bypass. This is an upstream fix by Rob Winch that shipped in Spring Security 6.2.2 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. CVE-2022-31692 authorization bypass vulnerability is NOT present in Spring Security 6.2.2-tuxcare.9. The fix (commit 1f481aafff) was authored by upstream Spring Security maintainer Marcus Da Coregio and was already included in the upstream 6.2.2 release before TuxCare onboarded it. The vulnerable pattern (AuthorizationFilter extending OncePerRequestFilter, which skips non-REQUEST dispatcher types) has been replaced with GenericFilterBean with explicit dispatcher type handling. The target version has even stronger security defaults than the original fix, applying authorization to ERROR and ASYNC dispatcher types by default (filterErrorDispatch=true, filterAsyncDispatch=true), whereas the 5.6.9/5.7.5 fix conservatively skipped them by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 authorization bypass vulnerability is NOT present in Spring Security 6.2.2-tuxcare.9. The fix (commit 1f481aafff) was authored by upstream Spring Security maintainer Marcus Da Coregio and was already included in the upstream 6.2.2 release before TuxCare onboarded it. The vulnerable pattern (AuthorizationFilter extending OncePerRequestFilter, which skips non-REQUEST dispatcher types) has been replaced with GenericFilterBean with explicit dispatcher type handling. The target version has even stronger security defaults than the original fix, applying authorization to ERROR and ASYNC dispatcher types by default (filterErrorDispatch=true, filterAsyncDispatch=true), whereas the 5.6.9/5.7.5 fix conservatively skipped them by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T22:45:14.636645+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 6.2.2-tuxcare.9 is NOT AFFECTED by CVE-2023-20862. The vulnerability (improper logout context cleaning) was fixed by upstream Spring Security in commits 2d52fb8e4b (Clear Repository on Logout, 2023-03-14) and 8d664bc4c2 (DelegatingSecurityContextRepository fix, 2023-03-17) authored by Marcus Da Coregio. Both fixes were already present in the upstream 6.2.2 release that Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 6.2.2-tuxcare.9 is NOT AFFECTED by CVE-2023-20862. The vulnerability (improper logout context cleaning) was fixed by upstream Spring Security in commits 2d52fb8e4b (Clear Repository on Logout, 2023-03-14) and 8d664bc4c2 (DelegatingSecurityContextRepository fix, 2023-03-17) authored by Marcus Da Coregio. Both fixes were already present in the upstream 6.2.2 release that Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. CVE-2024-22234 affects Spring Security versions 6.2.x prior to 6.2.2. The target is version 6.2.2-tuxcare.9, which contains the upstream fix that was already present in the 6.2.2 release. The vulnerability involved AuthenticationTrustResolver.isFullyAuthenticated() incorrectly returning true when passed a null authentication parameter, leading to broken access control. The fix added an explicit isAuthenticated() method with proper null checking, which is present in the target at core/src/main/java/org/springframework/security/authentication/AuthenticationTrustResolver.java lines 81-83. The fix was authored by Rob Winch (rwinch@users.noreply.github.com) and was included in the upstream 6.2.2 release before TuxCare's initial onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "impact_statement": "CVE-2024-22234 affects Spring Security versions 6.2.x prior to 6.2.2. The target is version 6.2.2-tuxcare.9, which contains the upstream fix that was already present in the 6.2.2 release. The vulnerability involved AuthenticationTrustResolver.isFullyAuthenticated() incorrectly returning true when passed a null authentication parameter, leading to broken access control. The fix added an explicit isAuthenticated() method with proper null checking, which is present in the target at core/src/main/java/org/springframework/security/authentication/AuthenticationTrustResolver.java lines 81-83. The fix was authored by Rob Winch (rwinch@users.noreply.github.com) and was included in the upstream 6.2.2 release before TuxCare's initial onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T16:49:36.466974+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation, which was introduced in version 6.2.5 (commit d169d5a835, March 2024). The target version 6.2.2 predates this feature entirely. The annotation, its processing infrastructure, and all related code are absent from the codebase. Since the vulnerable feature does not exist in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation, which was introduced in version 6.2.5 (commit d169d5a835, March 2024). The target version 6.2.2 predates this feature entirely. The annotation, its processing infrastructure, and all related code are absent from the codebase. Since the vulnerable feature does not exist in t..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:23:11.597840+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.2 is NOT affected by CVE-2025-22223. The vulnerable code (UniqueSecurityAnnotationScanner) was introduced in version 6.4.0-M4 (July 2024) and does not exist in 6.2.2. Version 6.2.2 uses Spring Framework's MergedAnnotations API with TYPE_HIERARCHY search strategy, which correctly resolves annotations on parameterized type hierarchies. The CVE fix was only backported to 6.4.3,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.2 is NOT affected by CVE-2025-22223. The vulnerable code (UniqueSecurityAnnotationScanner) was introduced in version 6.4.0-M4 (July 2024) and does not exist in 6.2.2. Version 6.2.2 uses Spring Framework's MergedAnnotations API with TYPE_HIERARCHY search strategy, which correctly resolves annotations on parameterized type hierarchies. The CVE fix was only backported to 6.4.3,..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T10:49:55.998641+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.2.2 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.2.2 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T11:37:35.533056+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. Spring Security 6.2.2 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 6.2.2 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in Spring Security 6.4.0 (September 2024), which postdates the target version by multiple minor releases. The entire OneTimeToken authentication feature does not exist in version 6.2.2. Exhaustive searches confirm zero occurrences of OneTimeToken-related code in the target co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in Spring Security 6.4.0 (September 2024), which postdates the target version by multiple minor releases. The entire OneTimeToken authentication feature does not exist in version 6.2.2. Exhaustive searches confirm zero occurrences of OneTimeToken-related code in the target co..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:26:25.287433+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2026-59277. The vulnerability concerns the InetAddressMatchers utility class with matchInternal() and matchExternal() builders for classifying IP addresses as internal (private) or external (public). This utility class does not exist in Spring Security 6.2.2 or any version up to 6.5.11 available in this repository. The feature appears to have been in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.2 is not affected by CVE-2026-59277. The vulnerability concerns the InetAddressMatchers utility class with matchInternal() and matchExternal() builders for classifying IP addresses as internal (private) or external (public). This utility class does not exist in Spring Security 6.2.2 or any version up to 6.5.11 available in this repository. The feature appears to have been in..."
    }
  ]
}