{ "@id": "urn:uuid:a7fef8d1-23dd-41ca-b56b-c3b0b7583816", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:21:00.444930+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6. The target (Spring Framework 4.1.9.RELEASE) is compiled with sourceCompatibility=1.6 and targetCompatibility=1.6, meaning it requires Java 6 or later to run. Since Java 6 (JDK 1.6) and later versions fixed the Pattern.compile complexity issue, the target cannot be exploited. A...", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6. The target (Spring Framework 4.1.9.RELEASE) is compiled with sourceCompatibility=1.6 and targetCompatibility=1.6, meaning it requires Java 6 or later to run. Since Java 6 (JDK 1.6) and later versions fixed the Pattern.compile complexity issue, the target cannot be exploited. A..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.1.9.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2730" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.1.9.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5, targeting unsafe deserialization of proxy classes. The target (Spring Framework 4.1.9.RELEASE-tuxcare.2) contains the complete upstream fix from 2011-07-21 (commit 7d8aa05c407 by Juergen Hoeller). The fix added an acceptProxyClasses flag to ConfigurableObjectInputStream.resolveProxyClass() that throws NotSerializableException when proxy class ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5, targeting unsafe deserialization of proxy classes. The target (Spring Framework 4.1.9.RELEASE-tuxcare.2) contains the complete upstream fix from 2011-07-21 (commit 7d8aa05c407 by Juergen Hoeller). The fix added an acceptProxyClasses flag to ConfigurableObjectInputStream.resolveProxyClass() that throws NotSerializableException when proxy class ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 4.1.9.RELEASE. The vulnerability allowed directory traversal via crafted URLs containing colon characters in path segments (e.g., /a/:b/../../file), which were incorrectly treated as URI scheme prefixes, bypassing path normalization. The fix was committed by upstream vendor Rossen Stoyanchev (rstoyanchev@gopivotal.com) on May 15, 2014 (commit 8ee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3578" }, "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 4.1.9.RELEASE. The vulnerability allowed directory traversal via crafted URLs containing colon characters in path segments (e.g., /a/:b/../../file), which were incorrectly treated as URI scheme prefixes, bypassing path normalization. The fix was committed by upstream vendor Rossen Stoyanchev (rstoyanchev@gopivotal.com) on May 15, 2014 (commit 8ee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses java.util.Random after initial seeding). The target version 4.1.9.RELEASE already contains the upstream fix (commit d63cfc8eeb) that replaced AlternativeJdkIdGenerator with JdkIdGenerator, which uses cryptographically secure UUID.r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-0201" }, "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses java.util.Random after initial seeding). The target version 4.1.9.RELEASE already contains the upstream fix (commit d63cfc8eeb) that replaced AlternativeJdkIdGenerator with JdkIdGenerator, which uses cryptographically secure UUID.r..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. The target Spring Framework 4.1.9.RELEASE-tuxcare.2 is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). All RFD protection mechanisms from the upstream patches are present in the target code. The fix was authored by upstream Spring maintainers (Rossen Stoyanchev, rstoyanchev@pivotal.io) and shipped in the upstream v4.1.9.RELEASE before TuxCare onboarded this version. The vulnerable pattern (unprotected JSONP responses and improper URL parameter handling) is not present because it was removed by the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-5211" }, "impact_statement": "The target Spring Framework 4.1.9.RELEASE-tuxcare.2 is NOT affected by CVE-2015-5211 (Reflected File Download vulnerability). All RFD protection mechanisms from the upstream patches are present in the target code. The fix was authored by upstream Spring maintainers (Rossen Stoyanchev, rstoyanchev@pivotal.io) and shipped in the upstream v4.1.9.RELEASE before TuxCare onboarded this version. The vulnerable pattern (unprotected JSONP responses and improper URL parameter handling) is not present because it was removed by the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2016-5007 affects version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2016-5007" }, "action_statement": "Vulnerability CVE-2016-5007 affects version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-11040" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2018-1199 affects version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1199" }, "action_statement": "Vulnerability CVE-2018-1199 affects version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework version 4.1.9.RELEASE is not affected by CVE-2018-1257. The vulnerability requires the selector header feature with Spring EL expression parsing in STOMP subscriptions, which was introduced in version 4.2.0.RC1 (April 2015). Version 4.1.9.RELEASE predates this feature and contains no SpEL expression parsing in the messaging/websocket modules, making the ReDoS attack vector impo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1257" }, "impact_statement": "not_affected \u2014 Spring Framework version 4.1.9.RELEASE is not affected by CVE-2018-1257. The vulnerability requires the selector header feature with Spring EL expression parsing in STOMP subscriptions, which was introduced in version 4.2.0.RC1 (April 2015). Version 4.1.9.RELEASE predates this feature and contains no SpEL expression parsing in the messaging/websocket modules, making the ReDoS attack vector impo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-10T04:21:00.444930+00:00", "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the proxy-exclusion regression is absent. In spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:177, method resolution passes the target class directly to ClassUtils.getMostSpecificMethod and then resolves bridge methods, without excluding proxy classes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1258" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the proxy-exclusion regression is absent. In spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:177, method resolution passes the target class directly to ClassUtils.getMostSpecificMethod and then resolves bridge methods, without excluding proxy classes." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1271" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1272" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2018-15756 affects version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-15756" }, "action_statement": "Vulnerability CVE-2018-15756 affects version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22096" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2024-22233 does not affect version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, and this version declares none of the classes the fix changes. Version 4.1.9.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-r4q3-7g4q-x89m (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-22233" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, and this version declares none of the classes the fix changes. Version 4.1.9.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-r4q3-7g4q-x89m (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2025-41249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.1.9.RELEASE-tuxcare.4" } } ], "timestamp": "2026-11-09T17:56:12.286464+00:00", "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 4.1.9.RELEASE-tuxcare.4 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2026-41848" } } ] }