{ "@id": "urn:uuid:dd7f7088-9b64-4728-81ce-a340424b81b8", "role": "Document Creator", "author": "https://tuxcare.com", "version": 49, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:50:03.446715+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-10-30T12:19:00.095877+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is a JDK-level algorithmic complexity vulnerability affecting Sun JDK before version 1.6 when used with Spring Framework 1.1.0-2.5.6 or 3.0.0.M1-M2. The target (Spring Framework 4.3.25.RELEASE) requires JDK 8+ per README.md line 43, which is far beyond the vulnerable JDK versions. Additionally, Spring 4.3.25.RELEASE includes upstream protections: the PATTERN_ACCESS_THRESHOLD defen...", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 CVE-2009-1190 is a JDK-level algorithmic complexity vulnerability affecting Sun JDK before version 1.6 when used with Spring Framework 1.1.0-2.5.6 or 3.0.0.M1-M2. The target (Spring Framework 4.3.25.RELEASE) requires JDK 8+ per README.md line 43, which is far beyond the vulnerable JDK versions. Additionally, Spring 4.3.25.RELEASE includes upstream protections: the PATTERN_ACCESS_THRESHOLD defen..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-06T17:32:10.656819+00:00", "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.25.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2730" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.25.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-03T09:40:00.094131+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes) was fixed in upstream commit 7d8aa05c40 by Juergen Hoeller in July 2011, which added the acceptProxyClasses flag mechanism to ConfigurableObjectInputStream. This fix was already present in the upstream 4.3.25.RELEASE when TuxCare onboarded it (commit 15f8875037). The def...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes) was fixed in upstream commit 7d8aa05c40 by Juergen Hoeller in July 2011, which added the acceptProxyClasses flag mechanism to ConfigurableObjectInputStream. This fix was already present in the upstream 4.3.25.RELEASE when TuxCare onboarded it (commit 15f8875037). The def..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 4.3.25.RELEASE. The directory traversal vulnerability was fixed in the upstream release by commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev on May 15, 2014), which was already included in the upstream 4.3.25.RELEASE before TuxCare onboarded it. The target code at spring-core/src/main/java/org/springframework/util/Str...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3578" }, "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 4.3.25.RELEASE. The directory traversal vulnerability was fixed in the upstream release by commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev on May 15, 2014), which was already included in the upstream 4.3.25.RELEASE before TuxCare onboarded it. The target code at spring-core/src/main/java/org/springframework/util/Str..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-03T19:08:09.478470+00:00", "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses java.util.Random after initial seed). The fix changed to JdkIdGenerator which uses UUID.randomUUID() for cryptographically secure session IDs. This upstream fix by Rossen Stoyanchev (commit 52b8f34468) shipped in Spring 4.1.5.RELEA...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-0201" }, "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses java.util.Random after initial seed). The fix changed to JdkIdGenerator which uses UUID.randomUUID() for cryptographically secure session IDs. This upstream fix by Rossen Stoyanchev (commit 52b8f34468) shipped in Spring 4.1.5.RELEA..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-03T12:59:16.129211+00:00", "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) does not affect Spring Framework 4.3.25.RELEASE. The upstream fix (commit 2bd1daa75e by rstoyanchev@pivotal.io) was included in Spring Framework 4.2.2.RELEASE (October 2015), and version 4.3.25.RELEASE already contains all protective measures: JSONP comment prefix, URL parameter parsing hardening, null checks, and JAF presence validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-5211" }, "impact_statement": "CVE-2015-5211 (Reflected File Download attack) does not affect Spring Framework 4.3.25.RELEASE. The upstream fix (commit 2bd1daa75e by rstoyanchev@pivotal.io) was included in Spring Framework 4.2.2.RELEASE (October 2015), and version 4.3.25.RELEASE already contains all protective measures: JSONP comment prefix, URL parameter parsing hardening, null checks, and JAF presence validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-03T13:12:13.552310+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. The target Spring Framework 4.3.25.RELEASE is not affected by CVE-2016-5007. The vulnerability concerns inconsistent URL pattern matching between Spring Security and Spring MVC that could lead to authorization bypass. The upstream fix introduces a unified introspection API (MatchableHandlerMapping interface, HandlerMappingIntrospector class, and RequestMatchResult class) that allows security frameworks to query handler mappings using the SAME pattern matching logic as the web layer. This fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from Pivotal/Spring and was already included in the upstream 4.3.25.RELEASE when TuxCare onboarded it (commit 15f887503). The fix commit a30ab30e4e is an ancestor of both the onboarding commit and the current HEAD (76ce96b8ec).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "The target Spring Framework 4.3.25.RELEASE is not affected by CVE-2016-5007. The vulnerability concerns inconsistent URL pattern matching between Spring Security and Spring MVC that could lead to authorization bypass. The upstream fix introduces a unified introspection API (MatchableHandlerMapping interface, HandlerMappingIntrospector class, and RequestMatchResult class) that allows security frameworks to query handler mappings using the SAME pattern matching logic as the web layer. This fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from Pivotal/Spring and was already included in the upstream 4.3.25.RELEASE when TuxCare onboarded it (commit 15f887503). The fix commit a30ab30e4e is an ancestor of both the onboarding commit and the current HEAD (76ce96b8ec).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-03T13:53:55.157124+00:00", "status_notes": "Vulnerability CVE-2018-11040 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. The target version 4.3.25.RELEASE is not affected by CVE-2018-11040. The vulnerability required JSONP support to be enabled by default through query parameters \"jsonp\" and \"callback\" in MappingJackson2JsonView. The fix (commit 874859493b) was introduced by upstream Spring Framework in version 4.3.18.RELEASE, which changed the jsonpParameterNames initialization from containing [\"jsonp\", \"callback\"] to an empty set, disabling JSONP by default. Since the target version 4.3.25.RELEASE is newer than 4.3.18.RELEASE, it already contains this upstream fix. The vulnerable pattern was never present in the version TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11040" }, "impact_statement": "The target version 4.3.25.RELEASE is not affected by CVE-2018-11040. The vulnerability required JSONP support to be enabled by default through query parameters \"jsonp\" and \"callback\" in MappingJackson2JsonView. The fix (commit 874859493b) was introduced by upstream Spring Framework in version 4.3.18.RELEASE, which changed the jsonpParameterNames initialization from containing [\"jsonp\", \"callback\"] to an empty set, disabling JSONP by default. Since the target version 4.3.25.RELEASE is newer than 4.3.18.RELEASE, it already contains this upstream fix. The vulnerable pattern was never present in the version TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-03T01:04:00.220847+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 The target spring-framework 4.3.25.RELEASE is not affected by CVE-2018-1199. The vulnerability concerns URL path parameter handling that could bypass security constraints through unnormalized paths. The upstream fix (commit b9ebdaaf3710db473a2e1fec8641c316483a22aa by Rossen Stoyanchev) was included in Spring Framework 4.3.15.RELEASE (April 2018) and is present in the target's 4.3.25.RELEASE bas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 The target spring-framework 4.3.25.RELEASE is not affected by CVE-2018-1199. The vulnerability concerns URL path parameter handling that could bypass security constraints through unnormalized paths. The upstream fix (commit b9ebdaaf3710db473a2e1fec8641c316483a22aa by Rossen Stoyanchev) was included in Spring Framework 4.3.15.RELEASE (April 2018) and is present in the target's 4.3.25.RELEASE bas..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-10-30T09:10:31.335583+00:00", "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1257" }, "impact_statement": "not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-10T04:21:00.444930+00:00", "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the regression that excluded JDK proxy classes from method resolution is absent. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly to method resolution, and spring-core/src/main/java/org/springframework/util/ClassUtils.java:1194 resolves public methods through targetClass.getMethod(...), preserving resolution against the proxy class.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1258" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the regression that excluded JDK proxy classes from method resolution is absent. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly to method resolution, and spring-core/src/main/java/org/springframework/util/ClassUtils.java:1194 resolves public methods through targetClass.getMethod(...), preserving resolution against the proxy class." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-10-30T18:37:44.893805+00:00", "status_notes": "Vulnerability CVE-2018-1271 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 4.3.25.RELEASE. The upstream vendor (Spring team) fixed this vulnerability in version 4.3.15 (March 2018), and the fix was already included when TuxCare onboarded version 4.3.25.RELEASE. The target contains all required defenses: processPath() normalizes backslashes and removes duplicate slashes; isInvalidEncoded...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1271" }, "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 4.3.25.RELEASE. The upstream vendor (Spring team) fixed this vulnerability in version 4.3.15 (March 2018), and the fix was already included when TuxCare onboarded version 4.3.25.RELEASE. The target contains all required defenses: processPath() normalizes backslashes and removes duplicate slashes; isInvalidEncoded..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1272" }, "action_statement": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-11-03T13:34:53.925887+00:00", "status_notes": "Vulnerability CVE-2018-15756 does not affect version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core. The target Spring Framework 4.3.25.RELEASE is NOT vulnerable to CVE-2018-15756. The upstream fix for this DoS vulnerability was already included in the 4.3.25.RELEASE when it was released upstream. The fix (commit 044772641d authored by Rossen Stoyanchev on Oct 8, 2018) added two critical defenses: (1) a MAX_RANGES=100 limit to reject requests with excessive ranges, and (2) validation that the sum of all ranges is less than the resource length to prevent overlapping/wide ranges. Both defenses are present in the target code at HttpRange.java lines 47, 134-136, and 183-193. Since the CVE affects \"versions 4.3.x prior to 4.3.20\" and the target is 4.3.25 (>4.3.20), the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15756" }, "impact_statement": "The target Spring Framework 4.3.25.RELEASE is NOT vulnerable to CVE-2018-15756. The upstream fix for this DoS vulnerability was already included in the 4.3.25.RELEASE when it was released upstream. The fix (commit 044772641d authored by Rossen Stoyanchev on Oct 8, 2018) added two critical defenses: (1) a MAX_RANGES=100 limit to reject requests with excessive ranges, and (2) validation that the sum of all ranges is less than the resource length to prevent overlapping/wide ranges. Both defenses are present in the target code at HttpRange.java lines 47, 134-136, and 183-193. Since the CVE affects \"versions 4.3.x prior to 4.3.20\" and the target is 4.3.25 (>4.3.20), the vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-10-05T16:35:18.546938+00:00", "status_notes": "Vulnerability CVE-2021-22096 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core, and is fixed in 4.3.25.RELEASE-tuxcare.6.", "vulnerability": { "name": "CVE-2021-22096" }, "action_statement": "Vulnerability CVE-2021-22096 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core, and is fixed in 4.3.25.RELEASE-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-10-29T03:48:46.502543+00:00", "status_notes": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2024-22233" }, "action_statement": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2025-41249" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.25.RELEASE-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2026-41848" }, "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.5 of org.springframework:spring-core." } ] }