{
  "@id": "urn:uuid:a5178a1a-cdfc-47ed-8e1d-4ee5ae0d9267",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 37,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:11:35.672073+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is NOT present in Spring Framework 3.1.1.RELEASE. The vulnerability required a readObject() method in AbstractRegexpMethodPointcut that would recompile regex patterns during deserialization, enabling CPU exhaustion attacks via malicious regex patterns with multiple optional groups. This vulnerable code pattern was removed by upstream Spring Framework in commit 9306d6dbaa (April 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is NOT present in Spring Framework 3.1.1.RELEASE. The vulnerability required a readObject() method in AbstractRegexpMethodPointcut that would recompile regex patterns during deserialization, enabling CPU exhaustion attacks via malicious regex patterns with multiple optional groups. This vulnerable code pattern was removed by upstream Spring Framework in commit 9306d6dbaa (April 20..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:17:46.916788+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core. Version 3.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected below 3.0.6), NVD (affected up to 3.0.5), Snyk (affected below 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Version 3.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected below 3.0.6), NVD (affected up to 3.0.5), Snyk (affected below 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:38:00.146680+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of proxy classes. The target (3.1.1.RELEASE-tuxcare.6) contains the upstream fix (commit 7d8aa05c40 by jhoeller@vmware.com, 2011-07-21) that shipped in Spring 3.1.1.RELEASE (2012-02-16), 7 months before TuxCare's involvement. The fix adds an acceptProxyClasses flag that throws NotSerializableException when false, bloc...",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5 via unsafe deserialization of proxy classes. The target (3.1.1.RELEASE-tuxcare.6) contains the upstream fix (commit 7d8aa05c40 by jhoeller@vmware.com, 2011-07-21) that shipped in Spring 3.1.1.RELEASE (2012-02-16), 7 months before TuxCare's involvement. The fix adds an acceptProxyClasses flag that throws NotSerializableException when false, bloc..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 is fixed in version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2014-3578"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:06:19.212631+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 3.1.1.RELEASE-tuxcare.6 is not affected by CVE-2015-0201. The vulnerability concerns predictable session ID generation in the Java SockJS client, which was introduced in Spring Framework 4.0. This target version (3.1.1) predates SockJS support entirely and contains no WebSocket, messaging, or SockJS modules. Exhaustive searches across all Java files, module structures, dependen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1.RELEASE-tuxcare.6 is not affected by CVE-2015-0201. The vulnerability concerns predictable session ID generation in the Java SockJS client, which was introduced in Spring Framework 4.0. This target version (3.1.1) predates SockJS support entirely and contains no WebSocket, messaging, or SockJS modules. Exhaustive searches across all Java files, module structures, dependen..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 is fixed in version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2015-5211"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 is fixed in version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 is a false positive for org.springframework:spring-core 3.1.1.RELEASE-tuxcare.2. direct vulnerability is in Spring Framework project - affected versions are 4.3.0-4.3.17 and 5.0.0-5.0.6, version 3.1.1.RELEASE is not in this range",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "direct vulnerability is in Spring Framework project - affected versions are 4.3.0-4.3.17 and 5.0.0-5.0.6, version 3.1.1.RELEASE is not in this range"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 is a false positive for org.springframework:spring-core 3.1.1.RELEASE-tuxcare.2. direct vulnerability is in Spring Framework project - affected versions are spring-messaging 4.3.0-4.3.16 and 5.0.0-5.0.5 (spring-messaging module does not exist before 4.0), version 3.1.1.RELEASE is not in this range",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "direct vulnerability is in Spring Framework project - affected versions are spring-messaging 4.3.0-4.3.16 and 5.0.0-5.0.5 (spring-messaging module does not exist before 4.0), version 3.1.1.RELEASE is not in this range"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:48:12.612717+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "action_statement": "Vulnerability CVE-2018-1258 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1271"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:02:19.515243+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "action_statement": "Vulnerability CVE-2018-15756 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-09T07:53:00.128797+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 3.1.1.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 3.1.1.RELEASE-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@3.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-09T07:53:00.128797+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 3.1.1.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 3.1.1.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 3.1.1.RELEASE-tuxcare.4."
    }
  ]
}