{
  "@id": "urn:uuid:cbef6ab4-9b26-4916-9093-f374a7b3e96f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:24:00.586682+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T12:45:01.272779+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is fundamentally a JDK vulnerability (algorithmic complexity in Pattern.compile before JDK 1.6) rather than a Spring Framework vulnerability. While Spring Framework 5.0.13.RELEASE contains the code patterns mentioned in the CVE (PatternEditor calling Pattern.compile without validation, HttpInvokerServiceExporter deserializing untrusted objects), the target version runs on JDK 8+ w...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is fundamentally a JDK vulnerability (algorithmic complexity in Pattern.compile before JDK 1.6) rather than a Spring Framework vulnerability. While Spring Framework 5.0.13.RELEASE contains the code patterns mentioned in the CVE (PatternEditor calling Pattern.compile without validation, HttpInvokerServiceExporter deserializing untrusted objects), the target version runs on JDK 8+ w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-06T17:38:27.865569+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.0.13.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.0.13.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T09:50:00.107701+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.0.13.RELEASE is not affected by CVE-2011-2894. The vulnerability (unrestricted deserialization of proxy classes in RMI/HTTP remoting services) was fixed by upstream in July 2011 via commit 7d8aa05c40. The fix added an `acceptProxyClasses` flag to ConfigurableObjectInputStream and RemoteInvocationSerializingExporter, causing the deserializer to throw NotSerializableException w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.0.13.RELEASE is not affected by CVE-2011-2894. The vulnerability (unrestricted deserialization of proxy classes in RMI/HTTP remoting services) was fixed by upstream in July 2011 via commit 7d8aa05c40. The fix added an `acceptProxyClasses` flag to ConfigurableObjectInputStream and RemoteInvocationSerializingExporter, causing the deserializer to throw NotSerializableException w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in this Spring Framework 5.0.13.RELEASE target. The fix commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by upstream Spring team member rstoyanchev@gopivotal.com in May 2014) was already included in the upstream Spring Framework 5.0.13.RELEASE before TuxCare onboarded it. The fix adds validation in StringUtils.cleanPath() t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in this Spring Framework 5.0.13.RELEASE target. The fix commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by upstream Spring team member rstoyanchev@gopivotal.com in May 2014) was already included in the upstream Spring Framework 5.0.13.RELEASE before TuxCare onboarded it. The fix adds validation in StringUtils.cleanPath() t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T19:14:50.891843+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.0.13.RELEASE is not affected by CVE-2015-0201. The vulnerability was fixed in upstream version 4.1.5 (January 2015) by switching the SockJS client's session ID generator from the predictable AlternativeJdkIdGenerator (which uses java.util.Random after initial seed) to the cryptographically secure JdkIdGenerator (which calls UUID.randomUUID() using SecureRandom). Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.0.13.RELEASE is not affected by CVE-2015-0201. The vulnerability was fixed in upstream version 4.1.5 (January 2015) by switching the SockJS client's session ID generator from the predictable AlternativeJdkIdGenerator (which uses java.util.Random after initial seed) to the cryptographically secure JdkIdGenerator (which calls UUID.randomUUID() using SecureRandom). Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:06:45.482707+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2015-5211 Reflected File Download (RFD) vulnerability is NOT present in Spring Framework 5.0.13.RELEASE. The upstream vendor (Spring Framework project) applied comprehensive RFD protections in commit 2bd1daa75e (October 2015), nearly 2 years before Spring 5.0.0.RELEASE (September 2017). All defenses are present in the target: (1) JSONP responses prefixed with /**/ to break batch script syntax, (2) extension whitelisting in AbstractMessageConverterMethodProcessor, (3) Content-Disposition header forcing safe filenames for unsafe extensions, (4) proper path parameter handling. The fix was shipped in the upstream release that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 Reflected File Download (RFD) vulnerability is NOT present in Spring Framework 5.0.13.RELEASE. The upstream vendor (Spring Framework project) applied comprehensive RFD protections in commit 2bd1daa75e (October 2015), nearly 2 years before Spring 5.0.0.RELEASE (September 2017). All defenses are present in the target: (1) JSONP responses prefixed with /**/ to break batch script syntax, (2) extension whitelisting in AbstractMessageConverterMethodProcessor, (3) Content-Disposition header forcing safe filenames for unsafe extensions, (4) proper path parameter handling. The fix was shipped in the upstream release that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:11.201920+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. The target Spring Framework 5.0.13.RELEASE is NOT affected by CVE-2016-5007. The vulnerability involved pattern matching discrepancies between Spring Security's authorization checks and Spring MVC's request routing, potentially allowing authorization bypass. The fix\u2014a unified pattern-matching API (MatchableHandlerMapping interface and HandlerMappingIntrospector helper)\u2014was introduced by upstream Spring developers in version 4.3.1 (April 2016, commit a30ab30e4e). This fix is present in 5.0.13.RELEASE, which was released after 4.3.1. The vulnerable code pattern (absence of unified matching infrastructure) does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target Spring Framework 5.0.13.RELEASE is NOT affected by CVE-2016-5007. The vulnerability involved pattern matching discrepancies between Spring Security's authorization checks and Spring MVC's request routing, potentially allowing authorization bypass. The fix\u2014a unified pattern-matching API (MatchableHandlerMapping interface and HandlerMappingIntrospector helper)\u2014was introduced by upstream Spring developers in version 4.3.1 (April 2016, commit a30ab30e4e). This fix is present in 5.0.13.RELEASE, which was released after 4.3.1. The vulnerable code pattern (absence of unified matching infrastructure) does not exist in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:58.947122+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. The target Spring Framework 5.0.13.RELEASE is NOT vulnerable to CVE-2018-11040. The upstream fix that disables JSONP by default was already present in Spring Framework 5.0.13.RELEASE when TuxCare onboarded it. The vulnerable code pattern (automatic JSONP support via default \"jsonp\" and \"callback\" query parameters) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target Spring Framework 5.0.13.RELEASE is NOT vulnerable to CVE-2018-11040. The upstream fix that disables JSONP by default was already present in Spring Framework 5.0.13.RELEASE when TuxCare onboarded it. The vulnerable code pattern (automatic JSONP support via default \"jsonp\" and \"callback\" query parameters) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T01:08:46.751659+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework 5.0.x before 5.0.3. The target version 5.0.13.RELEASE is after the fixed version and contains the complete upstream fix for path parameter handling vulnerabilities. The fix includes path normalization (backslash-to-forward-slash conversion, duplicate slash removal) and validation that rejects URL-decoded paths containing \"../\" or \"..\\\\\" traversal sequences...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework 5.0.x before 5.0.3. The target version 5.0.13.RELEASE is after the fixed version and contains the complete upstream fix for path parameter handling vulnerabilities. The fix includes path normalization (backslash-to-forward-slash conversion, duplicate slash removal) and validation that rejects URL-decoded paths containing \"../\" or \"..\\\\\" traversal sequences..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.0.13.RELEASE. The upstream vendor fix (commit b312a62f643c56ef0a3b830bd6b947d67a844e7d by Rossen Stoyanchev) was included in v5.0.6.RELEASE and all subsequent 5.0.x releases. The target version 5.0.13.RELEASE contains the complete fix: DefaultSubscriptionRegistry.getSelectorExpression() includes null-check before parsing selector expressions, a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.0.13.RELEASE. The upstream vendor fix (commit b312a62f643c56ef0a3b830bd6b947d67a844e7d by Rossen Stoyanchev) was included in v5.0.6.RELEASE and all subsequent 5.0.x releases. The target version 5.0.13.RELEASE contains the complete fix: DefaultSubscriptionRegistry.getSelectorExpression() includes null-check before parsing selector expressions, a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5, causing authorization bypass when method security checks fail on JDK dynamic proxy methods. The vulnerability stems from incorrect annotation matching - proxies never carry security annotations on their redeclared methods. The upstream fix was committed by Juergen Hoeller in April 2018 and first appeared in v5.0.6.RELEASE. Target version 5.0.13.RELEASE contains all fixes: AnnotationMethodMatcher now returns false for proxy classes before attempting getMostSpecificMethod, and CacheAspectSupport/ApplicationListenerMethodAdapter properly handle proxy class checks. The vulnerable pattern is not present because the fix shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5, causing authorization bypass when method security checks fail on JDK dynamic proxy methods. The vulnerability stems from incorrect annotation matching - proxies never carry security annotations on their redeclared methods. The upstream fix was committed by Juergen Hoeller in April 2018 and first appeared in v5.0.6.RELEASE. Target version 5.0.13.RELEASE contains all fixes: AnnotationMethodMatcher now returns false for proxy classes before attempting getMostSpecificMethod, and CacheAspectSupport/ApplicationListenerMethodAdapter properly handle proxy class checks. The vulnerable pattern is not present because the fix shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T18:55:57.643196+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 (directory traversal via URL-encoded path sequences) is NOT present in Spring Framework 5.0.13.RELEASE. The upstream fix was released in 5.0.5.RELEASE and is present in the target. All required defenses are in place: PathResourceResolver.isInvalidEncodedPath() validates URL-decoded paths for \"../\" and \"..\\\\\" patterns (lines 284-302 in webmvc, 193-211 in webflux), ResourceHttpReque...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 (directory traversal via URL-encoded path sequences) is NOT present in Spring Framework 5.0.13.RELEASE. The upstream fix was released in 5.0.5.RELEASE and is present in the target. All required defenses are in place: PathResourceResolver.isInvalidEncodedPath() validates URL-decoded paths for \"../\" and \"..\\\\\" patterns (lines 284-302 in webmvc, 193-211 in webflux), ResourceHttpReque..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:27:39.447287+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. The target Spring Framework 5.0.13.RELEASE is not affected by CVE-2018-1272. The vulnerability involved using weak Random() instead of SecureRandom() for multipart boundary generation, enabling attackers to predict boundaries and inject malicious multipart sections. The upstream fix (commit ab2410c754b67902f002bfcc0c3895bd7772d39f by rstoyanchev@pivotal.io) was introduced in Spring 5.0.5.RELEASE (March 2018). Since the target version 5.0.13.RELEASE is later than 5.0.5.RELEASE, the fix was already present in the upstream release when TuxCare onboarded this version. The current code uses SecureRandom() with lazy initialization (line 330 of MimeTypeUtils.java), eliminating the predictable boundary generation vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "The target Spring Framework 5.0.13.RELEASE is not affected by CVE-2018-1272. The vulnerability involved using weak Random() instead of SecureRandom() for multipart boundary generation, enabling attackers to predict boundaries and inject malicious multipart sections. The upstream fix (commit ab2410c754b67902f002bfcc0c3895bd7772d39f by rstoyanchev@pivotal.io) was introduced in Spring 5.0.5.RELEASE (March 2018). Since the target version 5.0.13.RELEASE is later than 5.0.5.RELEASE, the fix was already present in the upstream release when TuxCare onboarded this version. The current code uses SecureRandom() with lazy initialization (line 330 of MimeTypeUtils.java), eliminating the predictable boundary generation vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:42:24.827100+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2018-15756 is not present in Spring Framework 5.0.13.RELEASE. The vulnerability affects versions 5.0.x prior to 5.0.10, and the fix was already included in the upstream 5.0.10.RELEASE (October 2018). The target version 5.0.13.RELEASE already contains the upstream fix commit c8e320019f that adds range validation: (1) MAX_RANGES=100 limit to prevent excessive range counts, and (2) sum-of-ranges < resource-length check to prevent overlapping range attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is not present in Spring Framework 5.0.13.RELEASE. The vulnerability affects versions 5.0.x prior to 5.0.10, and the fix was already included in the upstream 5.0.10.RELEASE (October 2018). The target version 5.0.13.RELEASE already contains the upstream fix commit c8e320019f that adds range validation: (1) MAX_RANGES=100 limit to prevent excessive range counts, and (2) sum-of-ranges < resource-length check to prevent overlapping range attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-02T14:01:01.799318+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T04:24:00.586682+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request URI regex comparison is absent. Handler lookup directly iterates mappings at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:123, and the class ends without a CachedResult or cache-filter implementation at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:212.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request URI regex comparison is absent. Handler lookup directly iterates mappings at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:123, and the class ends without a CachedResult or cache-filter implementation at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:212."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-02T14:01:01.799318+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.0.13.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-02T14:01:01.799318+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}