{ "@id": "urn:uuid:faa7dc46-8e53-438c-8615-2ab0fc135bbf", "role": "Document Creator", "author": "https://tuxcare.com", "version": 51, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T17:43:00.057265+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-30T20:56:39.821004+00:00", "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2010-3700 (path parameter bypass). The vulnerability allowed attackers to bypass security constraints by adding semicolon-delimited path parameters (e.g., /secured;x=y/admin.html) to URLs. The target contains TWO upstream defenses: (1) StrictHttpFirewall (default since ~2016) REJECTS requests containing semicolons (lines 96-97, 146 in StrictHttpFire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2010-3700" }, "impact_statement": "not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2010-3700 (path parameter bypass). The vulnerability allowed attackers to bypass security constraints by adding semicolon-delimited path parameters (e.g., /secured;x=y/admin.html) to URLs. The target contains TWO upstream defenses: (1) StrictHttpFirewall (default since ~2016) REJECTS requests containing semicolons (lines 96-97, 146 in StrictHttpFire..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-30T19:27:56.776788+00:00", "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 6.3.10. The vulnerability (race condition allowing privilege escalation via shared SecurityContext in RunAsManager) was fixed by upstream commits SEC-1750 (thread isolation) and SEC-1967 (finally block restoration), both authored by SpringSource/VMware developers and shipped in the upstream release before TuxCare work began. All interceptor implem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2731" }, "impact_statement": "not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 6.3.10. The vulnerability (race condition allowing privilege escalation via shared SecurityContext in RunAsManager) was fixed by upstream commits SEC-1750 (thread isolation) and SEC-1967 (finally block restoration), both authored by SpringSource/VMware developers and shipped in the upstream release before TuxCare work began. All interceptor implem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-30T23:05:47.086442+00:00", "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 6.3.10. Both defenses from the 2011 SEC-1790 security patches are present in the target: (1) FirewalledResponse validates and rejects redirect locations containing CR/LF characters before passing to sendRedirect(), and (2) targetUrlParameter defaults to null, preventing reading attacker-controlled redirect URLs from request parameters. These fixes...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2732" }, "impact_statement": "not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 6.3.10. Both defenses from the 2011 SEC-1790 security patches are present in the target: (1) FirewalledResponse validates and rejects redirect locations containing CR/LF characters before passing to sendRedirect(), and (2) targetUrlParameter defaults to null, preventing reading attacker-controlled redirect URLs from request parameters. These fixes..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-30T22:45:57.313988+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 6.3.10 is NOT AFFECTED by CVE-2011-2894. The vulnerable code (ContextPropagatingRemoteInvocation class in the remoting/rmi package) does not exist in this version because the entire spring-security-remoting module was removed by upstream Spring Security in version 6.0.0-M1 (October 2021), before TuxCare onboarded version 6.3.10 (April 2026). The vulnerability involved des...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 Target Spring Security 6.3.10 is NOT AFFECTED by CVE-2011-2894. The vulnerable code (ContextPropagatingRemoteInvocation class in the remoting/rmi package) does not exist in this version because the entire spring-security-remoting module was removed by upstream Spring Security in version 6.0.0-M1 (October 2021), before TuxCare onboarded version 6.3.10 (April 2026). The vulnerability involved des..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-30T21:15:17.463976+00:00", "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 describes a timing attack vulnerability in DaoAuthenticationProvider where password validation is skipped when a user is not found, allowing username enumeration. The target Spring Security 6.3.10 contains the upstream fix (commit c076f0f2e1, authored by Rob Winch from VMware in September 2012) which was part of the original release that TuxCare onboarded. The fix introduces the m...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5055" }, "impact_statement": "not_affected \u2014 CVE-2012-5055 describes a timing attack vulnerability in DaoAuthenticationProvider where password validation is skipped when a user is not found, allowing username enumeration. The target Spring Security 6.3.10 contains the upstream fix (commit c076f0f2e1, authored by Rob Winch from VMware in September 2012) which was part of the original release that TuxCare onboarded. The fix introduces the m..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2014-0097" }, "action_statement": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-04T17:38:33.679325+00:00", "status_notes": "Vulnerability CVE-2014-3527 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2014-3527 is not present in Spring Security 6.3.10-tuxcare. The vulnerability was fixed by upstream Spring Security in 2014 (commit 934937d9c1, SEC-2688) before TuxCare began work on this repository. The fix changed DefaultServiceAuthenticationDetails to use the configured service URL instead of untrusted HTTP request headers (Host, scheme, port), preventing attackers from manipulating the service identity used in CAS proxy ticket authentication.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3527" }, "impact_statement": "CVE-2014-3527 is not present in Spring Security 6.3.10-tuxcare. The vulnerability was fixed by upstream Spring Security in 2014 (commit 934937d9c1, SEC-2688) before TuxCare began work on this repository. The fix changed DefaultServiceAuthenticationDetails to use the configured service URL instead of untrusted HTTP request headers (Host, scheme, port), preventing attackers from manipulating the service identity used in CAS proxy ticket authentication." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-03T12:31:59.702907+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. Target Spring Security 6.3.10 is not affected by CVE-2016-5007. The vulnerability affected versions 3.2.x, 4.0.x, and 4.1.0 (2016 and earlier), caused by pattern-matching disparities between Spring Security's authorization matcher and Spring MVC's controller mapper allowing authorization bypass. Both upstream fixes are present in the target: (1) MvcRequestMatcher class (lines 50+ in MvcRequestMatcher.java) using HandlerMappingIntrospector to align authorization matching with Spring MVC's logic, and (2) URL-encoded slash blocking in DefaultHttpFirewall (lines 60, 86-94) rejecting %2f and %2F by default. These fixes were introduced in upstream Spring Security 4.1.1 (July 2016) by Rob Winch and shipped in the release version that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "Target Spring Security 6.3.10 is not affected by CVE-2016-5007. The vulnerability affected versions 3.2.x, 4.0.x, and 4.1.0 (2016 and earlier), caused by pattern-matching disparities between Spring Security's authorization matcher and Spring MVC's controller mapper allowing authorization bypass. Both upstream fixes are present in the target: (1) MvcRequestMatcher class (lines 50+ in MvcRequestMatcher.java) using HandlerMappingIntrospector to align authorization matching with Spring MVC's logic, and (2) URL-encoded slash blocking in DefaultHttpFirewall (lines 60, 86-94) rejecting %2f and %2F by default. These fixes were introduced in upstream Spring Security 4.1.1 (July 2016) by Rob Winch and shipped in the release version that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-03T12:07:34.733429+00:00", "status_notes": "Vulnerability CVE-2016-9879 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 6.3.10 is NOT affected by CVE-2016-9879. The vulnerability allowed bypassing security constraints via URL-encoded slashes (%2f/%2F) in path parameters due to inconsistent servlet container handling. The fix was introduced by upstream commit 666e356ebc (Rob Winch, December 2016) and shipped in Spring Security 6.3.10 release. Both HttpFirewall implementations (DefaultHttpFirewall and StrictHttpFirewall) include protection: DefaultHttpFirewall.containsInvalidUrlEncodedSlash() rejects URIs with %2f/%2F by default, and StrictHttpFirewall blocks them via FORBIDDEN_FORWARDSLASH. The fix predates TuxCare's 6.3.10 onboarding (first TuxCare commit f09fc6dd88). Verdict: not_affected with vendor-fix justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-9879" }, "impact_statement": "Spring Security 6.3.10 is NOT affected by CVE-2016-9879. The vulnerability allowed bypassing security constraints via URL-encoded slashes (%2f/%2F) in path parameters due to inconsistent servlet container handling. The fix was introduced by upstream commit 666e356ebc (Rob Winch, December 2016) and shipped in Spring Security 6.3.10 release. Both HttpFirewall implementations (DefaultHttpFirewall and StrictHttpFirewall) include protection: DefaultHttpFirewall.containsInvalidUrlEncodedSlash() rejects URIs with %2f/%2F by default, and StrictHttpFirewall blocks them via FORBIDDEN_FORWARDSLASH. The fix predates TuxCare's 6.3.10 onboarding (first TuxCare commit f09fc6dd88). Verdict: not_affected with vendor-fix justification code_not_present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2017-4995 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 6.3.10 is not affected by CVE-2017-4995. The vulnerability pattern (unrestricted Jackson deserialization with default typing) is absent because the upstream vendor fix from commit 5dee8534cd (May 2017) is present in the codebase. The fix introduces AllowlistTypeIdResolver which validates classes during type resolution, rejecting non-whitelisted classes without Jackson annotations or explicit mixins. This fix was already included in the upstream Spring Security 5.0+ releases that TuxCare's 6.3.10 branch is based on.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-4995" }, "impact_statement": "Spring Security 6.3.10 is not affected by CVE-2017-4995. The vulnerability pattern (unrestricted Jackson deserialization with default typing) is absent because the upstream vendor fix from commit 5dee8534cd (May 2017) is present in the codebase. The fix introduces AllowlistTypeIdResolver which validates classes during type resolution, rejecting non-whitelisted classes without Jackson annotations or explicit mixins. This fix was already included in the upstream Spring Security 5.0+ releases that TuxCare's 6.3.10 branch is based on.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-03T16:43:48.744845+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 6.3.10-tuxcare.21. The vulnerability (URL path parameter bypass using semicolons and encoded slashes) was fixed by upstream Spring Security in commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2, which introduced StrictHttpFirewall as the default HTTP firewall. This fix was already included in the upstream Spring Security release before TuxCare onboar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Security 6.3.10-tuxcare.21. The vulnerability (URL path parameter bypass using semicolons and encoded slashes) was fixed by upstream Spring Security in commit 0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2, which introduced StrictHttpFirewall as the default HTTP firewall. This fix was already included in the upstream Spring Security release before TuxCare onboar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-15801 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2 due to JWT issuer validation using Java's URL.equals() method, which can treat different URL strings as equivalent through normalization. The target version 6.3.10 is NOT affected because the upstream fix (commit 19649db9ce \"Leave Issuer As String\") was already present in the upstream release that TuxCare onboarded. The fix refactored issuer validation to use string comparison instead of URL.equals(), eliminating the vulnerability. No TuxCare backport was needed as the fix shipped with the original upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15801" }, "impact_statement": "CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2 due to JWT issuer validation using Java's URL.equals() method, which can treat different URL strings as equivalent through normalization. The target version 6.3.10 is NOT affected because the upstream fix (commit 19649db9ce \"Leave Issuer As String\") was already present in the upstream release that TuxCare onboarded. The fix refactored issuer validation to use string comparison instead of URL.equals(), eliminating the vulnerability. No TuxCare backport was needed as the fix shipped with the original upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-03T12:23:26.744347+00:00", "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 6.3.10 is NOT affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder does not exist in this version - it was removed in Spring Security 5.0 (October 2017) as part of upstream architectural changes, years before the CVE was discovered in June 2019. The CVE only affects versions 4.2.x and older. The removal was an upstream change by Rob Winch that shipped in the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-11272" }, "impact_statement": "Spring Security 6.3.10 is NOT affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder does not exist in this version - it was removed in Spring Security 5.0 (October 2017) as part of upstream architectural changes, years before the CVE was discovered in June 2019. The CVE only affects versions 4.2.x and older. The removal was an upstream change by Rob Winch that shipped in the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-02T23:55:06.810370+00:00", "status_notes": "Vulnerability CVE-2019-3795 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.3.10-tuxcare codebase is not affected by CVE-2019-3795. The vulnerable pattern (calling setSeed() on an unseeded SecureRandom, which replaces rather than supplements entropy) is not present in the target. The fix was applied by upstream Spring Security developer Josh Cummings in March 2019 (commit 9c1eac79e2) and was already included in the Spring Security 6.3.10 re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-3795" }, "impact_statement": "not_affected \u2014 The target Spring Security 6.3.10-tuxcare codebase is not affected by CVE-2019-3795. The vulnerable pattern (calling setSeed() on an unseeded SecureRandom, which replaces rather than supplements entropy) is not present in the target. The fix was applied by upstream Spring Security developer Josh Cummings in March 2019 (commit 9c1eac79e2) and was already included in the Spring Security 6.3.10 re..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2020-5407" }, "action_statement": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-30T22:06:08.597138+00:00", "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security version 6.3.10 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that used a fixed null initialization vector with AES-CBC mode does not exist in the target codebase. This method was completely removed by upstream Spring Security in commit d996c2a2c6 (September 2022) before TuxCare onboarded version 6.3.10. All remaining public encry...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5408" }, "impact_statement": "not_affected \u2014 The target Spring Security version 6.3.10 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that used a fixed null initialization vector with AES-CBC mode does not exist in the target codebase. This method was completely removed by upstream Spring Security in commit d996c2a2c6 (September 2022) before TuxCare onboarded version 6.3.10. All remaining public encry..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2021-22119 affects Spring Security OAuth2 client code that allowed unbounded accumulation of authorization requests in HTTP sessions, leading to DoS. The target Spring Security 6.3.10-tuxcare.21 is NOT AFFECTED because the fix was already present in the upstream Spring Security 6.3.10 release (June 2025) that TuxCare onboarded in April 2026. The vulnerable pattern (storing multiple requests in a Map) is absent; the current code stores only ONE request per session, preventing memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22119" }, "impact_statement": "CVE-2021-22119 affects Spring Security OAuth2 client code that allowed unbounded accumulation of authorization requests in HTTP sessions, leading to DoS. The target Spring Security 6.3.10-tuxcare.21 is NOT AFFECTED because the fix was already present in the upstream Spring Security 6.3.10 release (June 2025) that TuxCare onboarded in April 2026. The vulnerable pattern (storing multiple requests in a Map) is absent; the current code stores only ONE request per session, preventing memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-03T05:11:00.089232+00:00", "status_notes": "Vulnerability CVE-2022-22976 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2022-22976 (BCrypt integer overflow with work factor 31) is NOT present in Spring Security 6.3.10. The upstream vendor fix authored by Josh Cummings was already included in the Spring Security 6.3.10 release that TuxCare onboarded. The vulnerable pattern (int overflow in `1 << 31`) has been replaced with safe long arithmetic (`1L << log_rounds`). This is an upstream fix, not a TuxCare backp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22976" }, "impact_statement": "not_affected \u2014 CVE-2022-22976 (BCrypt integer overflow with work factor 31) is NOT present in Spring Security 6.3.10. The upstream vendor fix authored by Josh Cummings was already included in the Spring Security 6.3.10 release that TuxCare onboarded. The vulnerable pattern (int overflow in `1 << 31`) has been replaced with safe long arithmetic (`1L << log_rounds`). This is an upstream fix, not a TuxCare backp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-03T12:18:14.184922+00:00", "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2022-22978 affects Spring Security's RegexRequestMatcher when the DEFAULT Pattern flag is 0, allowing authorization bypass via line terminators (\\n, \\r) in request paths. The target (Spring Security 6.3.10-tuxcare.21) already contains the upstream fix: DEFAULT = Pattern.DOTALL at RegexRequestMatcher.java:46. This fix was authored by Rob Winch (rwinch@users.noreply.github.com) in commit c6461d61ba (May 2022) and shipped in the upstream 6.3.10 release (ae1537b409, June 2025) before TuxCare onboarded it. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22978" }, "impact_statement": "CVE-2022-22978 affects Spring Security's RegexRequestMatcher when the DEFAULT Pattern flag is 0, allowing authorization bypass via line terminators (\\n, \\r) in request paths. The target (Spring Security 6.3.10-tuxcare.21) already contains the upstream fix: DEFAULT = Pattern.DOTALL at RegexRequestMatcher.java:46. This fix was authored by Rob Winch (rwinch@users.noreply.github.com) in commit c6461d61ba (May 2022) and shipped in the upstream 6.3.10 release (ae1537b409, June 2025) before TuxCare onboarded it. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2022-31692 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. CVE-2022-31692 is NOT present in spring-security 6.3.10 (target SHA d6fd5270dc). The vulnerability affects versions where AuthorizationFilter extends OncePerRequestFilter, which automatically skips FORWARD/INCLUDE dispatcher types, bypassing authorization checks. The target code extends GenericFilterBean with explicit dispatcher-type handling that allows FORWARD/INCLUDE to be filtered. The upstream fix (commit 1f481aafff, dated 2022-10-28) was already present in the Spring Security release before TuxCare onboarded it. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31692" }, "impact_statement": "CVE-2022-31692 is NOT present in spring-security 6.3.10 (target SHA d6fd5270dc). The vulnerability affects versions where AuthorizationFilter extends OncePerRequestFilter, which automatically skips FORWARD/INCLUDE dispatcher types, bypassing authorization checks. The target code extends GenericFilterBean with explicit dispatcher-type handling that allows FORWARD/INCLUDE to be filtered. The upstream fix (commit 1f481aafff, dated 2022-10-28) was already present in the Spring Security release before TuxCare onboarded it. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; >= 5.6.0, < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), Snyk (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-02T22:45:14.636645+00:00", "status_notes": "Vulnerability CVE-2023-20862 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 affects Spring Security versions 5.7.x prior to 5.7.8, 5.8.x prior to 5.8.3, and 6.0.x prior to 6.0.3. The target is Spring Security 6.3.10-tuxcare.21, which already contains the upstream fixes from commits 2d52fb8e4b (2023-03-14) and 8d664bc4c2 (2023-03-17) by Marcus Da Coregio. These fixes were shipped in the upstream Spring Security release and onboarded by TuxCare in April 20...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-20862" }, "impact_statement": "not_affected \u2014 CVE-2023-20862 affects Spring Security versions 5.7.x prior to 5.7.8, 5.8.x prior to 5.8.3, and 6.0.x prior to 6.0.3. The target is Spring Security 6.3.10-tuxcare.21, which already contains the upstream fixes from commits 2d52fb8e4b (2023-03-14) and 8d664bc4c2 (2023-03-17) by Marcus Da Coregio. These fixes were shipped in the upstream Spring Security release and onboarded by TuxCare in April 20..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2024-22234 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. The target Spring Security 6.3.10 is NOT vulnerable to CVE-2024-22234. The vulnerability (AuthenticationTrustResolver.isFullyAuthenticated() incorrectly returning true for null Authentication) was fixed in upstream Spring Security versions 6.1.7 and 6.2.2. Since the target is version 6.3.10, the fix was already part of the upstream release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-22234" }, "impact_statement": "The target Spring Security 6.3.10 is NOT vulnerable to CVE-2024-22234. The vulnerability (AuthenticationTrustResolver.isFullyAuthenticated() incorrectly returning true for null Authentication) was fixed in upstream Spring Security versions 6.1.7 and 6.2.2. Since the target is version 6.3.10, the fix was already part of the upstream release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), NVD (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), cve.org (>= 6.1.x, < 6.1.7; >= 6.2.x, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2), Snyk (>= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2; >= 6.1.0, < 6.1.7; >= 6.2.0, < 6.2.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-06T17:43:00.057265+00:00", "status_notes": "Vulnerability CVE-2024-22257 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 6.3.10 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-22257" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 6.3.10 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f3jh-qvm4-mg39 (affected up to 6.2.3), CVE record (affected up to 6.2.2), Snyk (affected up to 6.2.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-03T16:49:36.466974+00:00", "status_notes": "Vulnerability CVE-2024-38810 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2024-38810 affected Spring Security 6.3.0 and 6.3.1 due to missing advisor sorting in AuthorizationAdvisorProxyFactory, which could render @AuthorizeReturnObject security annotations ineffective. The target version 6.3.10 contains upstream fixes (commits 456604ab45, fcc1bd598d, 0cab7c8f15) that were already present in the upstream Spring Security 6.3.10 release. These fixes ensure authoriza...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38810" }, "impact_statement": "not_affected \u2014 CVE-2024-38810 affected Spring Security 6.3.0 and 6.3.1 due to missing advisor sorting in AuthorizationAdvisorProxyFactory, which could render @AuthorizeReturnObject security annotations ineffective. The target version 6.3.10 contains upstream fixes (commits 456604ab45, fcc1bd598d, 0cab7c8f15) that were already present in the upstream Spring Security 6.3.10 release. These fixes ensure authoriza..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-30T20:00:47.750212+00:00", "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.21 is NOT AFFECTED by CVE-2024-38827. The vulnerability (locale-dependent case conversion in authorization-critical string processing) was fixed in the upstream Spring Security 6.3.10 release before TuxCare onboarded it. All production code now uses explicit Locale arguments (Locale.ROOT or Locale.ENGLISH) with toLowerCase() and toUpperCase() methods, p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38827" }, "impact_statement": "not_affected \u2014 The target Spring Security 6.3.10-tuxcare.21 is NOT AFFECTED by CVE-2024-38827. The vulnerability (locale-dependent case conversion in authorization-critical string processing) was fixed in the upstream Spring Security 6.3.10 release before TuxCare onboarded it. All production code now uses explicit Locale arguments (Locale.ROOT or Locale.ENGLISH) with toLowerCase() and toUpperCase() methods, p..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-11-05T15:58:00.086678+00:00", "status_notes": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 6.3.10-tuxcare.22.", "vulnerability": { "name": "CVE-2025-22223" }, "action_statement": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 6.3.10-tuxcare.22." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22234" }, "impact_statement": "not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-30T10:49:55.998641+00:00", "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-41232" }, "impact_statement": "Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-28T18:34:10.986929+00:00", "status_notes": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2025-41248" }, "action_statement": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2026-22746" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-29T05:55:31.824924+00:00", "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22751" }, "impact_statement": "not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-15T12:46:01.751461+00:00", "status_notes": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 6.3.10-tuxcare.20.", "vulnerability": { "name": "CVE-2026-59276" }, "action_statement": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core, and is fixed in 6.3.10-tuxcare.20." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@6.3.10-tuxcare.6" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.6 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59277" }, "impact_statement": "not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6...." } ] }