{ "@id": "urn:uuid:0eeb41f4-c245-40e5-8919-0aa22001c52b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 6, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:51:00.040518+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 affected Spring Framework versions 1.1.0-2.5.6 and 3.0.0.M1-M2 through a denial-of-service vulnerability in deserialization of regex patterns. The target version 4.3.5.RELEASE contains an upstream fix from April 2009 (commit 9306d6dbaa) that removed the vulnerable custom readObject method which forced pattern recompilation from strings. The fix was shipped in Spring 3.0.0.M3 and a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 CVE-2009-1190 affected Spring Framework versions 1.1.0-2.5.6 and 3.0.0.M1-M2 through a denial-of-service vulnerability in deserialization of regex patterns. The target version 4.3.5.RELEASE contains an upstream fix from April 2009 (commit 9306d6dbaa) that removed the vulnerable custom readObject method which forced pattern recompilation from strings. The fix was shipped in Spring 3.0.0.M3 and a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-06T17:32:10.656819+00:00", "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.5.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2730" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.3.5.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 4.3.5.RELEASE is not affected by CVE-2011-2894. The vulnerability fix (adding acceptProxyClasses flag to prevent malicious proxy deserialization) was introduced by upstream Spring Framework in July 2011 (commit 7d8aa05c) and was already present in the upstream 4.3.5.RELEASE tag (December 2016) that TuxCare onboarded. The fix commit's author and committer are both jho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 The target Spring Framework 4.3.5.RELEASE is not affected by CVE-2011-2894. The vulnerability fix (adding acceptProxyClasses flag to prevent malicious proxy deserialization) was introduced by upstream Spring Framework in July 2011 (commit 7d8aa05c) and was already present in the upstream 4.3.5.RELEASE tag (December 2016) that TuxCare onboarded. The fix commit's author and committer are both jho..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is not present in spring-framework 4.3.5.RELEASE-tuxcare.2. The vulnerability was a directory traversal issue in StringUtils.cleanPath() that allowed attackers to craft URLs like \"/a/:b/../../file\" to traverse directories. The upstream fix (commit 8ee4651038 by Rossen Stoyanchev, May 2014) added validation to check if the prefix before a colon contains \"/\" and discards invalid pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3578" }, "impact_statement": "not_affected \u2014 CVE-2014-3578 is not present in spring-framework 4.3.5.RELEASE-tuxcare.2. The vulnerability was a directory traversal issue in StringUtils.cleanPath() that allowed attackers to craft URLs like \"/a/:b/../../file\" to traverse directories. The upstream fix (commit 8ee4651038 by Rossen Stoyanchev, May 2014) added validation to check if the prefix before a colon contains \"/\" and discards invalid pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which relies on java.util.Random). The target version 4.3.5.RELEASE already contains the upstream security fix (commit 52b8f34468) that replaced AlternativeJdkIdGenerator with JdkIdGenerator, which uses cryptographically secure UUID.randomUUID(). T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-0201" }, "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which relies on java.util.Random). The target version 4.3.5.RELEASE already contains the upstream security fix (commit 52b8f34468) that replaced AlternativeJdkIdGenerator with JdkIdGenerator, which uses cryptographically secure UUID.randomUUID(). T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2015-5211 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. The target Spring Framework 4.3.5.RELEASE is NOT vulnerable to CVE-2015-5211 (Reflected File Download / RFD). The upstream vendor (Spring/Pivotal) fixed this vulnerability in October 2015 (commits 2bd1daa75e, a95c3d820d, 03f547eb98), and version 4.3.5.RELEASE (released December 2016) already contained the complete fix when TuxCare onboarded it. All defensive mechanisms are present and active by default: (1) Content-Disposition header with safe filename for unknown extensions, (2) JSONP callback validation with pattern [0-9A-Za-z_\\.]*, (3) JSONP /**/ prefix, (4) path parameter (semicolon) handling. The fix commit was authored by rstoyanchev@pivotal.io (Pivotal/Spring team), confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-5211" }, "impact_statement": "The target Spring Framework 4.3.5.RELEASE is NOT vulnerable to CVE-2015-5211 (Reflected File Download / RFD). The upstream vendor (Spring/Pivotal) fixed this vulnerability in October 2015 (commits 2bd1daa75e, a95c3d820d, 03f547eb98), and version 4.3.5.RELEASE (released December 2016) already contained the complete fix when TuxCare onboarded it. All defensive mechanisms are present and active by default: (1) Content-Disposition header with safe filename for unknown extensions, (2) JSONP callback validation with pattern [0-9A-Za-z_\\.]*, (3) JSONP /**/ prefix, (4) path parameter (semicolon) handling. The fix commit was authored by rstoyanchev@pivotal.io (Pivotal/Spring team), confirming this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security (authorization) and Spring MVC (routing) that could lead to authorization bypass. The vulnerability required Spring Framework to lack an introspection API, forcing Spring Security to implement its own pattern matching logic with different behavior. The target repository (Spring Framework 4.3.5.RELEASE) contains the upstream fix (commit a30ab30e4e) that introduces the MatchableHandlerMapping interface and HandlerMappingIntrospector class, providing a consistent pattern matching API. This fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) and shipped in the upstream 4.3.5.RELEASE that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security (authorization) and Spring MVC (routing) that could lead to authorization bypass. The vulnerability required Spring Framework to lack an introspection API, forcing Spring Security to implement its own pattern matching logic with different behavior. The target repository (Spring Framework 4.3.5.RELEASE) contains the upstream fix (commit a30ab30e4e) that introduces the MatchableHandlerMapping interface and HandlerMappingIntrospector class, providing a consistent pattern matching API. This fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) and shipped in the upstream 4.3.5.RELEASE that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-11040" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2018-1199 affects version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1199" }, "action_statement": "Vulnerability CVE-2018-1199 affects version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2018-1257 is fixed in version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1257" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-10T04:21:00.444930+00:00", "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not exclude JDK proxy classes from method resolution. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly to method resolution and then resolves bridge methods. For ordinary JDK proxy invocations, spring-aop/src/main/java/org/springframework/aop/framework/JdkDynamicAopProxy.java:192 supplies the actual target object's class for advisor selection, allowing implementation methods to be inspected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1258" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not exclude JDK proxy classes from method resolution. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:190 passes the target class directly to method resolution and then resolves bridge methods. For ordinary JDK proxy invocations, spring-aop/src/main/java/org/springframework/aop/framework/JdkDynamicAopProxy.java:192 supplies the actual target object's class for advisor selection, allowing implementation methods to be inspected." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1271" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-1272" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2018-15756 is fixed in version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2018-15756" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22096" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-10T04:22:46.193289+00:00", "status_notes": "Vulnerability CVE-2024-22233 does not affect version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-request URI regular expression comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:128, handler mappings are iterated directly, with no cached-result lookup or URI regex comparison. The implementation at the same file:144 and :175 also lacks the cached-result class and cache filter.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2024-22233" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-request URI regular expression comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:128, handler mappings are iterated directly, with no cached-result lookup or URI regex comparison. The implementation at the same file:144 and :175 also lacks the cached-result class and cache filter." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2025-41249" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@4.3.5.RELEASE-tuxcare.3" } } ], "timestamp": "2026-11-05T20:09:22.479131+00:00", "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2026-41848" }, "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.5.RELEASE-tuxcare.3 of org.springframework:spring-core." } ] }