{
  "@id": "urn:uuid:226a135d-df33-4939-963a-bd95805cf744",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T12:01:46.642220+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6, exploitable through Spring Framework 1.1.0-2.5.6 and 3.0.0.M1-M2 via deserialized regex patterns. The target (Spring Framework 4.3.30.RELEASE) is not affected because: (1) it requires JDK 1.6+ (sourceCompatibility=1.6, build requires JDK 8+), and the underlying JDK vulnerabi...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6, exploitable through Spring Framework 1.1.0-2.5.6 and 3.0.0.M1-M2 via deserialized regex patterns. The target (Spring Framework 4.3.30.RELEASE) is not affected because: (1) it requires JDK 1.6+ (sourceCompatibility=1.6, build requires JDK 8+), and the underlying JDK vulnerabi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-06T17:29:00.077200+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.30.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.30.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T09:35:24.585014+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 fix was already present in upstream Spring Framework 4.3.30.RELEASE when TuxCare onboarded it. The vulnerability allowed deserialization of malicious proxy classes to execute arbitrary code. The fix (commit 7d8aa05c by Juergen Hoeller, July 2011) added an acceptProxyClasses flag that throws NotSerializableException when proxy class deserialization is rejected. This fix predates th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 fix was already present in upstream Spring Framework 4.3.30.RELEASE when TuxCare onboarded it. The vulnerability allowed deserialization of malicious proxy classes to execute arbitrary code. The fix (commit 7d8aa05c by Juergen Hoeller, July 2011) added an acceptProxyClasses flag that throws NotSerializableException when proxy class deserialization is rejected. This fix predates th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 does not affect Spring Framework 4.3.30.RELEASE. The directory traversal vulnerability in StringUtils.cleanPath() was fixed by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev on 2014-05-15, Issue SPR-11793). This fix was included in Spring Framework 4.0.5 and 3.2.9. Since the target version 4.3.30.RELEASE was released much later, it already ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 does not affect Spring Framework 4.3.30.RELEASE. The directory traversal vulnerability in StringUtils.cleanPath() was fixed by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev on 2014-05-15, Issue SPR-11793). This fix was included in Spring Framework 4.0.5 and 3.2.9. Since the target version 4.3.30.RELEASE was released much later, it already ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T19:04:00.051306+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then regular Random). The fix was applied in January 2015 (commit d63cfc8eeb, issue SPR-12658) by upstream developer Rossen Stoyanchev, changing to JdkIdGenerator which uses UUID.randomUUID() (cr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses SecureRandom only for initial seed, then regular Random). The fix was applied in January 2015 (commit d63cfc8eeb, issue SPR-12658) by upstream developer Rossen Stoyanchev, changing to JdkIdGenerator which uses UUID.randomUUID() (cr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:54:30.943101+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download / RFD) is NOT present in Spring Framework 4.3.30.RELEASE. The vulnerability defense was shipped in the upstream release that TuxCare onboarded. The fix (commit 2bd1daa75e by rstoyanchev@pivotal.io) adds Content-Disposition header protection that prevents browsers from using dangerous URL file extensions when saving responses. This defense is present in AbstractMessageConverterMethodProcessor.java and actively invoked before all HTTP response writes. Target version 4.3.30.RELEASE is above the CVE's stated upper bound (4.1.7) and contains the complete fix from the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download / RFD) is NOT present in Spring Framework 4.3.30.RELEASE. The vulnerability defense was shipped in the upstream release that TuxCare onboarded. The fix (commit 2bd1daa75e by rstoyanchev@pivotal.io) adds Content-Disposition header protection that prevents browsers from using dangerous URL file extensions when saving responses. This defense is present in AbstractMessageConverterMethodProcessor.java and actively invoked before all HTTP response writes. Target version 4.3.30.RELEASE is above the CVE's stated upper bound (4.1.7) and contains the complete fix from the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:06:45.482707+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 4.3.30.RELEASE. The vulnerability concerns URL pattern matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev) introduced the HandlerMappingIntrospector API and MatchableHandlerMapping interface to ensure consistent pattern matching. This fix was already included in the Spring Framework 4.3.30.RELEASE upstream release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare setup commit (0afd3c6d7c). All defense components are present and properly implemented in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 4.3.30.RELEASE. The vulnerability concerns URL pattern matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev) introduced the HandlerMappingIntrospector API and MatchableHandlerMapping interface to ensure consistent pattern matching. This fix was already included in the Spring Framework 4.3.30.RELEASE upstream release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare setup commit (0afd3c6d7c). All defense components are present and properly implemented in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:39.156684+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. The target Spring Framework 4.3.30.RELEASE is not affected by CVE-2018-11040. The vulnerability was fixed in upstream v4.3.18.RELEASE by commit 874859493bbda59739c38c7e52eb3625f247b93a authored by Sebastien Deleuze (upstream Spring maintainer), which disabled JSONP by default by changing jsonpParameterNames initialization from a pre-populated set to an empty set. This upstream fix was already included in v4.3.30.RELEASE when TuxCare onboarded it, as confirmed by git history showing the fix commit predates the first TuxCare commit (0afd3c6d7c).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target Spring Framework 4.3.30.RELEASE is not affected by CVE-2018-11040. The vulnerability was fixed in upstream v4.3.18.RELEASE by commit 874859493bbda59739c38c7e52eb3625f247b93a authored by Sebastien Deleuze (upstream Spring maintainer), which disabled JSONP by default by changing jsonpParameterNames initialization from a pre-populated set to an empty set. This upstream fix was already included in v4.3.30.RELEASE when TuxCare onboarded it, as confirmed by git history showing the fix commit predates the first TuxCare commit (0afd3c6d7c).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T00:50:41.219686+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 4.3.30.RELEASE-tuxcare.11. The vulnerability affecting versions before 4.3.14 involves URL path parameter bypass via specially-encoded path separators and traversal sequences. The upstream Spring Framework team fixed this issue in commit b9ebdaaf3710db473a2e1fec8641c316483a22aa (SPR-16616, dated 2018-03-21), which was included in the upstream 4.3...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 4.3.30.RELEASE-tuxcare.11. The vulnerability affecting versions before 4.3.14 involves URL path parameter bypass via specially-encoded path separators and traversal sequences. The upstream Spring Framework team fixed this issue in commit b9ebdaaf3710db473a2e1fec8641c316483a22aa (SPR-16616, dated 2018-03-21), which was included in the upstream 4.3..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T08:55:17.845672+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 fix is present in target version 4.3.30.RELEASE. The vulnerability allowed ReDoS attacks via malicious selector expressions in STOMP WebSocket subscriptions. The upstream fix (commit 246a6db1ca by Rossen Stoyanchev, April 17, 2018) made the selector header configurable and allows disabling it by setting selectorHeaderName to null. This fix was already included in Spring Framework ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 fix is present in target version 4.3.30.RELEASE. The vulnerability allowed ReDoS attacks via malicious selector expressions in STOMP WebSocket subscriptions. The upstream fix (commit 246a6db1ca by Rossen Stoyanchev, April 17, 2018) made the selector header configurable and allows disabling it by setting selectorHeaderName to null. This fix was already included in Spring Framework ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T04:20:04.842645+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable behavior that skips JDK proxy target classes during method resolution is absent. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the actual target class into method resolution and then resolves bridge methods. spring-core/src/main/java/org/springframework/util/ClassUtils.java:1183 retrieves the target class\u2019s public method.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable behavior that skips JDK proxy target classes during method resolution is absent. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the actual target class into method resolution and then resolves bridge methods. spring-core/src/main/java/org/springframework/util/ClassUtils.java:1183 retrieves the target class\u2019s public method."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T18:22:00.126197+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 4.3 prior to 4.3.15 and 5.0 prior to 5.0.5 with a directory traversal vulnerability when serving static resources from Windows filesystems. The target version 4.3.30.RELEASE already contains the complete upstream fix shipped in December 2020. All defense mechanisms are present: path normalization (backslash-to-forward-slash conversion, duplicate s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 affects Spring Framework versions 4.3 prior to 4.3.15 and 5.0 prior to 5.0.5 with a directory traversal vulnerability when serving static resources from Windows filesystems. The target version 4.3.30.RELEASE already contains the complete upstream fix shipped in December 2020. All defense mechanisms are present: path normalization (backslash-to-forward-slash conversion, duplicate s..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:31:13.211032+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. The target (Spring Framework 4.3.30.RELEASE) is not affected by CVE-2018-15756. The vulnerability involves HTTP Range header DoS attacks through excessive ranges or overlapping ranges. The fix (commit 044772641d) was authored by upstream Spring developer Rossen Stoyanchev (rstoyanchev@pivotal.io) and was already present in v4.3.30.RELEASE when TuxCare onboarded it. All fix components are verified present in the target: MAX_RANGES=100 limit, range count validation in parseRanges(), and sum validation in toResourceRegions(). The vulnerable pattern (lack of range validation) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target (Spring Framework 4.3.30.RELEASE) is not affected by CVE-2018-15756. The vulnerability involves HTTP Range header DoS attacks through excessive ranges or overlapping ranges. The fix (commit 044772641d) was authored by upstream Spring developer Rossen Stoyanchev (rstoyanchev@pivotal.io) and was already present in v4.3.30.RELEASE when TuxCare onboarded it. All fix components are verified present in the target: MAX_RANGES=100 limit, range count validation in parseRanges(), and sum validation in toResourceRegions(). The vulnerable pattern (lack of range validation) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:31.962159+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it has no CachedResult or cached request-URI regex comparison, the vulnerable operation behind this denial of service. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:119, handler lookup directly iterates mappings without consulting a URI cache. CORS lookup also iterates mappings at line 135, and the nested wrapper at line 207 only ignores attribute writes.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it has no CachedResult or cached request-URI regex comparison, the vulnerable operation behind this denial of service. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:119, handler lookup directly iterates mappings without consulting a URI cache. CORS lookup also iterates mappings at line 135, and the nested wrapper at line 207 only ignores attribute writes."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.3.30.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T13:40:07.481699+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-core, and is fixed in 4.3.30.RELEASE-tuxcare.11."
    }
  ]
}