{
  "@id": "urn:uuid:a10e609f-9356-47ba-9f43-6b065a09b273",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 49,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:43:00.057265+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T20:51:00.153763+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolon-delimited segments) to URLs. The upstream fix (SEC-1584, commit 7d97adc68789f4a191cee15de482530dd9d5c31d by Luke Taylor, October 2010) introduced HttpFirewall infrastructure that strips path parameters before security pattern matching. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolon-delimited segments) to URLs. The upstream fix (SEC-1584, commit 7d97adc68789f4a191cee15de482530dd9d5c31d by Luke Taylor, October 2010) introduced HttpFirewall infrastructure that strips path parameters before security pattern matching. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T19:22:00.172401+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target repository (Spring Security 6.2.7-tuxcare.8) is not affected because the vulnerability was fixed in upstream Spring Security releases from 2011-2012 (SEC-1750, SEC-1967), well before version 6.2.7. The fix creates an isolated SecurityContext for RunAs authentication instead of modifying the shared context, pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target repository (Spring Security 6.2.7-tuxcare.8) is not affected because the vulnerability was fixed in upstream Spring Security releases from 2011-2012 (SEC-1750, SEC-1967), well before version 6.2.7. The fix creates an isolated SecurityContext for RunAs authentication instead of modifying the shared context, pre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T23:00:22.873954+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.7 is NOT affected by CVE-2011-2732. The vulnerability (CRLF injection in logout redirect functionality) was fixed by the upstream Spring Security project in 2011 via commit 824464516c (SEC-1790). The fix was already present in the upstream 6.2.7 release that TuxCare onboarded. All defensive measures are functional: (1) FirewalledResponse validates and rejects redirect URLs c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.7 is NOT affected by CVE-2011-2732. The vulnerability (CRLF injection in logout redirect functionality) was fixed by the upstream Spring Security project in 2011 via commit 824464516c (SEC-1790). The fix was already present in the upstream 6.2.7 release that TuxCare onboarded. All defensive measures are functional: (1) FirewalledResponse validates and rejects redirect URLs c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T22:41:16.546891+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 affects Spring Security 2.0.0-2.0.6 and 3.0.0-3.0.5 via deserialization of SecurityContext objects in RMI remoting (ContextPropagatingRemoteInvocation). The target version 6.2.7 is not affected because the entire spring-security-remoting module was removed by upstream Spring Security in October 2021 (commit b2e6c60d94), shipping in version 6.0.0+. The vulnerable code does not exis...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security 2.0.0-2.0.6 and 3.0.0-3.0.5 via deserialization of SecurityContext objects in RMI remoting (ContextPropagatingRemoteInvocation). The target version 6.2.7 is not affected because the entire spring-security-remoting module was removed by upstream Spring Security in October 2021 (commit b2e6c60d94), shipping in version 6.0.0+. The vulnerable code does not exis..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T21:11:12.927650+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 6.2.7-tuxcare.8. The vulnerability (timing side-channel allowing username enumeration via password encoding only occurring when user exists) was fixed by upstream Spring Security in commit c076f0f2e1 authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream 6.2.7 release that TuxCare onboarded. The target code impleme...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 6.2.7-tuxcare.8. The vulnerability (timing side-channel allowing username enumeration via password encoding only occurring when user exists) was fixed by upstream Spring Security in commit c076f0f2e1 authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream 6.2.7 release that TuxCare onboarded. The target code impleme..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T17:00:47.802007+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. The target repository (Spring Security 6.2.7) is NOT affected by CVE-2014-3527. The vulnerability was fixed by the upstream Spring Security project in July 2014 (commit 934937d9c1) and this fix was already present in the upstream 6.2.7 release that TuxCare onboarded. The vulnerable code pattern (using untrusted HttpServletRequest data for CAS service URL construction) does not exist in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "The target repository (Spring Security 6.2.7) is NOT affected by CVE-2014-3527. The vulnerability was fixed by the upstream Spring Security project in July 2014 (commit 934937d9c1) and this fix was already present in the upstream 6.2.7 release that TuxCare onboarded. The vulnerable code pattern (using untrusted HttpServletRequest data for CAS service URL construction) does not exist in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. The target Spring Security 6.2.7 is NOT affected by CVE-2016-5007. The vulnerability concerned URL pattern matching discrepancies between Spring Security's authorization rules and Spring MVC's controller mappings, allowing attackers to bypass security by using URL variations (trailing slashes, .html extensions, encoded characters) that Spring Security didn't recognize but Spring MVC routed to protected controllers. The upstream vendor fixed this in two ways: (1) introducing MvcRequestMatcher class (commit e4c13e3c0e) that uses Spring MVC's HandlerMappingIntrospector for consistent matching, and (2) adding DefaultHttpFirewall checks (commit 666e356ebc) to block URL-encoded slashes. Both fixes, plus automatic MvcRequestMatcher usage when Spring MVC is present (commit c4d23f2b49), were shipped in the upstream Spring Security 6.2.7 release that TuxCare onboarded. All three commits are authored by upstream developers (rwinch@gopivotal.com, marcusdacoregio@gmail.com) and are ancestors of TuxCare's first onboarding commit (2a37cf61b4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target Spring Security 6.2.7 is NOT affected by CVE-2016-5007. The vulnerability concerned URL pattern matching discrepancies between Spring Security's authorization rules and Spring MVC's controller mappings, allowing attackers to bypass security by using URL variations (trailing slashes, .html extensions, encoded characters) that Spring Security didn't recognize but Spring MVC routed to protected controllers. The upstream vendor fixed this in two ways: (1) introducing MvcRequestMatcher class (commit e4c13e3c0e) that uses Spring MVC's HandlerMappingIntrospector for consistent matching, and (2) adding DefaultHttpFirewall checks (commit 666e356ebc) to block URL-encoded slashes. Both fixes, plus automatic MvcRequestMatcher usage when Spring MVC is present (commit c4d23f2b49), were shipped in the upstream Spring Security 6.2.7 release that TuxCare onboarded. All three commits are authored by upstream developers (rwinch@gopivotal.com, marcusdacoregio@gmail.com) and are ancestors of TuxCare's first onboarding commit (2a37cf61b4).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 6.2.7 is not affected by CVE-2016-9879. The target repository contains the upstream fix that detects and rejects URL-encoded slashes (%2f or %2F) in request URIs. The vulnerable pattern (missing encoded slash detection) is not present because the fix was already included in the upstream Spring Security 6.2.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "Spring Security 6.2.7 is not affected by CVE-2016-9879. The target repository contains the upstream fix that detects and rejects URL-encoded slashes (%2f or %2F) in request URIs. The vulnerable pattern (missing encoded slash detection) is not present because the fix was already included in the upstream Spring Security 6.2.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. Target Spring Security 6.2.7 is not affected by CVE-2017-4995. The upstream fix (commit 5dee8534cd by Rob Winch, May 31, 2017) was already present in the Spring Security 6.2.7 release when TuxCare onboarded it on 2026-07-26. The fix introduces AllowlistTypeIdResolver which validates class names during Jackson deserialization, preventing arbitrary class instantiation through untrusted JSON data.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "Target Spring Security 6.2.7 is not affected by CVE-2017-4995. The upstream fix (commit 5dee8534cd by Rob Winch, May 31, 2017) was already present in the Spring Security 6.2.7 release when TuxCare onboarded it on 2026-07-26. The fix introduces AllowlistTypeIdResolver which validates class names during Jackson deserialization, preventing arbitrary class instantiation through untrusted JSON data.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T16:43:48.744845+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 affects Spring Security versions 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1. The target is Spring Security 6.2.7-tuxcare.8, which already contains the upstream fix introduced in commit 0eef5b4b by Rob Winch. The fix (StrictHttpFirewall) rejects HTTP requests containing semicolons (literal or URL-encoded) in path components, preventing path parameter bypass atta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Security versions 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1. The target is Spring Security 6.2.7-tuxcare.8, which already contains the upstream fix introduced in commit 0eef5b4b by Rob Winch. The fix (StrictHttpFirewall) rejects HTTP requests containing semicolons (literal or URL-encoded) in path components, preventing path parameter bypass atta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2018-15801 does not affect Spring Security 6.2.7. The vulnerability involved JWT issuer validation using Java's URL.equals() method, which can perform DNS resolution and treat semantically different issuer URLs as equal, allowing authorization bypass. The fix (commit 19649db9ce, November 2018) changed issuer validation to use String comparison instead of URL object comparison. This fix was already present in the upstream Spring Security 6.2.7 release that TuxCare onboarded, authored by Josh Cummings (upstream maintainer). The target uses a delegation pattern with JwtClaimValidator but performs the same String-based comparison, providing equivalent protection against the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 does not affect Spring Security 6.2.7. The vulnerability involved JWT issuer validation using Java's URL.equals() method, which can perform DNS resolution and treat semantically different issuer URLs as equal, allowing authorization bypass. The fix (commit 19649db9ce, November 2018) changed issuer validation to use String comparison instead of URL object comparison. This fix was already present in the upstream Spring Security 6.2.7 release that TuxCare onboarded, authored by Josh Cummings (upstream maintainer). The target uses a delegation pattern with JwtClaimValidator but performs the same String-based comparison, providing equivalent protection against the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x up to 4.2.12 and older versions. This class was removed from Spring Security in October 2017 (commit 12dbf2e961, 5.0+) by upstream maintainer Rob Winch, well before version 6.2.7 was released. The target repository at version 6.2.7 does not contain the vulnerable PlaintextPasswordEncoder class. The modern replacement NoOpPasswordEncoder uses safe String.equals() comparison which correctly returns false when comparing any string (including \"null\") to a null stored password, preventing the vulnerability. This is an upstream architectural change that eliminated the vulnerable code entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x up to 4.2.12 and older versions. This class was removed from Spring Security in October 2017 (commit 12dbf2e961, 5.0+) by upstream maintainer Rob Winch, well before version 6.2.7 was released. The target repository at version 6.2.7 does not contain the vulnerable PlaintextPasswordEncoder class. The modern replacement NoOpPasswordEncoder uses safe String.equals() comparison which correctly returns false when comparing any string (including \"null\") to a null stored password, preventing the vulnerability. This is an upstream architectural change that eliminated the vulnerable code entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T23:54:12.578535+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2019-3795 does not affect Spring Security 6.2.7-tuxcare.8. The vulnerable pattern (calling setSeed() before nextBytes() on SecureRandom) is not present. The upstream fix was authored by Josh Cummings on 2019-03-11 (commit 9c1eac79e2) and shipped with the upstream Spring Security 6.2.7 release that TuxCare onboarded on 2026-07-26. The fix ensures SecureRandom is initialized with OS entropy b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3795 does not affect Spring Security 6.2.7-tuxcare.8. The vulnerable pattern (calling setSeed() before nextBytes() on SecureRandom) is not present. The upstream fix was authored by Josh Cummings on 2019-03-11 (commit 9c1eac79e2) and shipped with the upstream Spring Security 6.2.7 release that TuxCare onboarded on 2026-07-26. The fix ensures SecureRandom is initialized with OS entropy b..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T22:02:33.258307+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 6.2.7 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that created text encryptors using a fixed null initialization vector with CBC mode was completely removed from the codebase by upstream commit d996c2a2c in September 2022 (author: Rob Winch <rwinch@users.noreply.github.com>). This removal occurred before TuxCare onboarded version 6...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 6.2.7 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that created text encryptors using a fixed null initialization vector with CBC mode was completely removed from the codebase by upstream commit d996c2a2c in September 2022 (author: Rob Winch <rwinch@users.noreply.github.com>). This removal occurred before TuxCare onboarded version 6..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2021-22119 is NOT present in Spring Security 6.2.7. The vulnerable pattern (unbounded Map accumulation in OAuth2 authorization request storage) was fixed in upstream commit 35f5ebdbcf (April 2021) by Craig Andrews. The fix was already included in the upstream 6.2.7 release (October 2024) before TuxCare onboarded it. The target code stores only ONE authorization request per session, replacing old requests instead of accumulating them in a Map, preventing the DoS attack via memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 is NOT present in Spring Security 6.2.7. The vulnerable pattern (unbounded Map accumulation in OAuth2 authorization request storage) was fixed in upstream commit 35f5ebdbcf (April 2021) by Craig Andrews. The fix was already included in the upstream 6.2.7 release (October 2024) before TuxCare onboarded it. The target code stores only ONE authorization request per session, replacing old requests instead of accumulating them in a Map, preventing the DoS attack via memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T05:10:03.859518+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository Spring Security 6.2.7 is not affected by CVE-2022-22976. The integer overflow vulnerability in BCrypt (when work factor is set to 31) was fixed in upstream commit 3f13fa0285d1304d31b5963c134ed3fb4a8b49ba by Josh Cummings on June 17, 2021. This fix was already included in Spring Security 6.2.7 when TuxCare onboarded the version. The vulnerable pattern (int rounds = 1 << log...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 The target repository Spring Security 6.2.7 is not affected by CVE-2022-22976. The integer overflow vulnerability in BCrypt (when work factor is set to 31) was fixed in upstream commit 3f13fa0285d1304d31b5963c134ed3fb4a8b49ba by Josh Cummings on June 17, 2021. This fix was already included in Spring Security 6.2.7 when TuxCare onboarded the version. The vulnerable pattern (int rounds = 1 << log..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2022-22978: Target version 6.2.7 is NOT AFFECTED. The vulnerability (RegexRequestMatcher using Pattern flag 0 instead of Pattern.DOTALL, allowing newline characters in URLs to bypass regex authorization checks) was fixed in upstream Spring Security commit c6461d61ba (May 13, 2022) before the 6.2.7 release. The fix was already present when TuxCare onboarded version 6.2.7 on July 26, 2026 (commit 2a37cf61b4 by evasilev@cloudlinux.com). The target code at HEAD (6d971abbe2) shows the fix is present: `private static final int DEFAULT = Pattern.DOTALL;` at line 46 of RegexRequestMatcher.java. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978: Target version 6.2.7 is NOT AFFECTED. The vulnerability (RegexRequestMatcher using Pattern flag 0 instead of Pattern.DOTALL, allowing newline characters in URLs to bypass regex authorization checks) was fixed in upstream Spring Security commit c6461d61ba (May 13, 2022) before the 6.2.7 release. The fix was already present when TuxCare onboarded version 6.2.7 on July 26, 2026 (commit 2a37cf61b4 by evasilev@cloudlinux.com). The target code at HEAD (6d971abbe2) shows the fix is present: `private static final int DEFAULT = Pattern.DOTALL;` at line 46 of RegexRequestMatcher.java. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2022-31692 is NOT present in spring-security 6.2.7. The vulnerability involved AuthorizationFilter incorrectly extending OncePerRequestFilter, which prevented proper authorization checks on FORWARD/INCLUDE dispatcher types. The upstream fix (commit 1f481aafff) changed AuthorizationFilter to extend GenericFilterBean and manually implement dispatcher type filtering. This fix was already present in the upstream Spring Security 6.2.7 release that TuxCare onboarded. The target code at web/src/main/java/org/springframework/security/web/access/intercept/AuthorizationFilter.java:51 extends GenericFilterBean (not OncePerRequestFilter) and includes the complete fix logic with manual dispatcher type handling (lines 82-90, 107-115). Additionally, version 6.2.7 evolved the defaults to be more secure: filterErrorDispatch=true and filterAsyncDispatch=true by default, meaning authorization applies to all dispatcher types by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "CVE-2022-31692 is NOT present in spring-security 6.2.7. The vulnerability involved AuthorizationFilter incorrectly extending OncePerRequestFilter, which prevented proper authorization checks on FORWARD/INCLUDE dispatcher types. The upstream fix (commit 1f481aafff) changed AuthorizationFilter to extend GenericFilterBean and manually implement dispatcher type filtering. This fix was already present in the upstream Spring Security 6.2.7 release that TuxCare onboarded. The target code at web/src/main/java/org/springframework/security/web/access/intercept/AuthorizationFilter.java:51 extends GenericFilterBean (not OncePerRequestFilter) and includes the complete fix logic with manual dispatcher type handling (lines 82-90, 107-115). Additionally, version 6.2.7 evolved the defaults to be more secure: filterErrorDispatch=true and filterAsyncDispatch=true by default, meaning authorization applies to all dispatcher types by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T22:40:42.716029+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository Spring Security 6.2.7-tuxcare.8 is NOT AFFECTED by CVE-2023-20862. The vulnerability (logout not properly cleaning security context) has been fixed by upstream commits that were already present in Spring Security 6.2.7 when TuxCare onboarded it. Both required fixes are present in HEAD: (1) SecurityContextLogoutHandler now saves an empty SecurityContext on logout, and (2) H...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 The target repository Spring Security 6.2.7-tuxcare.8 is NOT AFFECTED by CVE-2023-20862. The vulnerability (logout not properly cleaning security context) has been fixed by upstream commits that were already present in Spring Security 6.2.7 when TuxCare onboarded it. Both required fixes are present in HEAD: (1) SecurityContextLogoutHandler now saves an empty SecurityContext on logout, and (2) H..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. The target repository (Spring Security 6.2.7-tuxcare.8) is NOT vulnerable to CVE-2024-22234. The vulnerability, which caused AuthenticationTrustResolver.isFullyAuthenticated() to erroneously return true when passed a null authentication parameter, was fixed in upstream Spring Security 6.2.2. The fix was already present in the upstream 6.2.7 release when TuxCare onboarded it via commit 2a37cf61b4. The vulnerable code pattern does not exist in the target - the fixed code with proper null checking is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "impact_statement": "The target repository (Spring Security 6.2.7-tuxcare.8) is NOT vulnerable to CVE-2024-22234. The vulnerability, which caused AuthenticationTrustResolver.isFullyAuthenticated() to erroneously return true when passed a null authentication parameter, was fixed in upstream Spring Security 6.2.2. The fix was already present in the upstream 6.2.7 release when TuxCare onboarded it via commit 2a37cf61b4. The vulnerable code pattern does not exist in the target - the fixed code with proper null checking is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-06T17:43:00.057265+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.2.3, and version 6.2.7 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 6.2.3), CVE record (last affected 6.2.2), Snyk (fixed in 6.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.2.3, and version 6.2.7 is a later release of the same line. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (fixed in 6.2.3), CVE record (last affected 6.2.2), Snyk (fixed in 6.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T16:49:36.466974+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security version 6.2.7-tuxcare.8 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3.0 and does not exist in version 6.2.7. Without this annotation and its supporting infrastructure, the vulnerable code path cannot be triggered. This is a Rule 5 Type A1 case where the input type (methods annotate...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security version 6.2.7-tuxcare.8 is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation, which was introduced in Spring Security 6.3.0 and does not exist in version 6.2.7. Without this annotation and its supporting infrastructure, the vulnerable code path cannot be triggered. This is a Rule 5 Type A1 case where the input type (methods annotate..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-02T16:10:00.409582+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-05T16:31:00.055998+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 6.2.7-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "action_statement": "Vulnerability CVE-2025-22223 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 6.2.7-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-02T16:10:00.409582+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T10:49:55.998641+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 6.2.7 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.2.7 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T18:34:10.986929+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "action_statement": "Vulnerability CVE-2025-41248 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-02T16:10:00.409582+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security version 6.2.7-tuxcare.8 does not contain the vulnerable JdbcOneTimeTokenService component or the OneTimeToken authentication feature at all. This feature was introduced in upstream Spring Security version 6.4.0, which postdates the target version. The vulnerability cannot manifest because the code that implements one-time token authentication does not exist in this ve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security version 6.2.7-tuxcare.8 does not contain the vulnerable JdbcOneTimeTokenService component or the OneTimeToken authentication feature at all. This feature was introduced in upstream Spring Security version 6.4.0, which postdates the target version. The vulnerability cannot manifest because the code that implements one-time token authentication does not exist in this ve..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-15T14:28:00.747532+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 6.2.7-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 6.2.7-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-59277. The vulnerable component `InetAddressMatchers` with `matchInternal()` and `matchExternal()` builders was introduced in Spring Security 7.1 (February 2026), well after version 6.2.7 was released. The class literally does not exist in the target codebase. While 6.2.7 contains an older `IpAddressMatcher` class for CIDR-based matching, it doe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-59277. The vulnerable component `InetAddressMatchers` with `matchInternal()` and `matchExternal()` builders was introduced in Spring Security 7.1 (February 2026), well after version 6.2.7 was released. The class literally does not exist in the target codebase. While 6.2.7 contains an older `IpAddressMatcher` class for CIDR-based matching, it doe..."
    }
  ]
}