{
  "@id": "urn:uuid:46e0fd83-d540-4ffa-be0a-5d05919bf9b2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:25:00.091559+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2009-1190. The vulnerability requires Sun JDK before 1.6 (with algorithmic complexity issues in Pattern.compile), but Spring 5.1.13 requires JDK 8+ as confirmed in documentation and build configuration. The underlying JDK vulnerability was fixed in JDK 1.6 (2006), 14 years before Spring 5.1 was released. While Spring 5.1.13 still contains P...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2009-1190. The vulnerability requires Sun JDK before 1.6 (with algorithmic complexity issues in Pattern.compile), but Spring 5.1.13 requires JDK 8+ as confirmed in documentation and build configuration. The underlying JDK vulnerability was fixed in JDK 1.6 (2006), 14 years before Spring 5.1 was released. While Spring 5.1.13 still contains P..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:41:41.363551+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.13.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.13.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:55:00.073520+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes enabling arbitrary code execution) was fixed by upstream Spring in July 2011 via commit 7d8aa05c by Juergen Hoeller. This fix shipped in the upstream 5.1.13.RELEASE, which TuxCare later onboarded. The defense code (acceptProxyClasses flag with validation in ConfigurableOb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes enabling arbitrary code execution) was fixed by upstream Spring in July 2011 via commit 7d8aa05c by Juergen Hoeller. This fix shipped in the upstream 5.1.13.RELEASE, which TuxCare later onboarded. The defense code (acceptProxyClasses flag with validation in ConfigurableOb..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 5.1.13.RELEASE. The directory traversal vulnerability in StringUtils.cleanPath() was fixed by upstream Spring Framework in commit 8ee465103850a3dca018273fe5952e40d5c45a66 (May 2014) and included in all releases from v4.1.0 onwards. The target version 5.1.13.RELEASE already contained this fix when TuxCare onboarded it. The vulnerable code pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 5.1.13.RELEASE. The directory traversal vulnerability in StringUtils.cleanPath() was fixed by upstream Spring Framework in commit 8ee465103850a3dca018273fe5952e40d5c45a66 (May 2014) and included in all releases from v4.1.0 onwards. The target version 5.1.13.RELEASE already contained this fix when TuxCare onboarded it. The vulnerable code pattern ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:21:08.318837+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The target version 5.1.13.RELEASE is not affected because the fix was already present in the upstream release. The vulnerable AlternativeJdkIdGenerator (which used a seeded java.util.Random) was replaced with JdkIdGenerator (using UUID.randomUUID() with SecureRandom) in Sprin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The target version 5.1.13.RELEASE is not affected because the fix was already present in the upstream release. The vulnerable AlternativeJdkIdGenerator (which used a seeded java.util.Random) was replaced with JdkIdGenerator (using UUID.randomUUID() with SecureRandom) in Sprin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:19:28.539186+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.1.13.RELEASE. The upstream fix commit 2bd1daa75ee0b8ec33608ca6ab065ef3e1815543 was already included in the upstream 5.1.13.RELEASE that TuxCare onboarded. The fix was authored by Pivotal/Spring team (rstoyanchev@pivotal.io) and first appeared in v4.2.2.RELEASE (CVE affected up to v4.2.1). All RFD protections are present: safe extension whitelist, Content-Disposition header forcing for unsafe extensions, path parameter validation, and MediaTypeFactory replacing deprecated JAF.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.1.13.RELEASE. The upstream fix commit 2bd1daa75ee0b8ec33608ca6ab065ef3e1815543 was already included in the upstream 5.1.13.RELEASE that TuxCare onboarded. The fix was authored by Pivotal/Spring team (rstoyanchev@pivotal.io) and first appeared in v4.2.2.RELEASE (CVE affected up to v4.2.1). All RFD protections are present: safe extension whitelist, Content-Disposition header forcing for unsafe extensions, path parameter validation, and MediaTypeFactory replacing deprecated JAF.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:20:11.775734+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.1.13.RELEASE. The vulnerability stemmed from inconsistent pattern matching between Spring Security and Spring MVC, allowing attackers to bypass authorization by exploiting these differences. The fix (commit a30ab30e4e, \"Introduce HandlerMapping introspection API\") was already present in the upstream 5.1.13.RELEASE when TuxCare onboarded it. The fix provides HandlerMappingIntrospector, MatchableHandlerMapping, and RequestMatchResult classes that enable Spring Security to use Spring MVC's exact pattern matching logic. Both AbstractUrlHandlerMapping and RequestMappingHandlerMapping implement the interface with match() methods that expose their internal matching algorithms. This is an upstream fix authored by rstoyanchev@pivotal.io, shipped in the release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.1.13.RELEASE. The vulnerability stemmed from inconsistent pattern matching between Spring Security and Spring MVC, allowing attackers to bypass authorization by exploiting these differences. The fix (commit a30ab30e4e, \"Introduce HandlerMapping introspection API\") was already present in the upstream 5.1.13.RELEASE when TuxCare onboarded it. The fix provides HandlerMappingIntrospector, MatchableHandlerMapping, and RequestMatchResult classes that enable Spring Security to use Spring MVC's exact pattern matching logic. Both AbstractUrlHandlerMapping and RequestMappingHandlerMapping implement the interface with match() methods that expose their internal matching algorithms. This is an upstream fix authored by rstoyanchev@pivotal.io, shipped in the release before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:02:12.850766+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework 5.0.x < 5.0.7 and 4.3.x < 4.3.18 where JSONP support in MappingJackson2JsonView was enabled by default via \"jsonp\" and \"callback\" query parameters. The target version 5.1.13.RELEASE is NOT affected because JSONP support was completely removed in upstream commit ac37b678a3 (2018-06-07 by Sebastien Deleuze) before the 5.1.13 release. The target contains no jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, and no JSONP query parameter processing code. This is an upstream fix that shipped with the original 5.1.13.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework 5.0.x < 5.0.7 and 4.3.x < 4.3.18 where JSONP support in MappingJackson2JsonView was enabled by default via \"jsonp\" and \"callback\" query parameters. The target version 5.1.13.RELEASE is NOT affected because JSONP support was completely removed in upstream commit ac37b678a3 (2018-06-07 by Sebastien Deleuze) before the 5.1.13 release. The target contains no jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, and no JSONP query parameter processing code. This is an upstream fix that shipped with the original 5.1.13.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:17:00.151843+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.1.13.RELEASE. The vulnerability affects versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. All fix commits (SPR-16616, SPR-16296, SPR-16526) are present in the target, shipped with the upstream 5.1.13.RELEASE. The code contains complete path normalization defenses: backslash-to-slash conversion, duplicate slash removal, and encoded path trave...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.1.13.RELEASE. The vulnerability affects versions 4.3.x before 4.3.14 and 5.0.x before 5.0.3. All fix commits (SPR-16616, SPR-16296, SPR-16526) are present in the target, shipped with the upstream 5.1.13.RELEASE. The code contains complete path normalization defenses: backslash-to-slash conversion, duplicate slash removal, and encoded path trave..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older versions. The target repository is version 5.1.13.RELEASE-tuxcare.1. The fix (commit ff2228fdaf, SPR-16732) was already present in the upstream Spring Framework release 5.1.13.RELEASE before TuxCare onboarded it on 2026-10-25. The fix allows administrators to disable selector expression parsin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older versions. The target repository is version 5.1.13.RELEASE-tuxcare.1. The fix (commit ff2228fdaf, SPR-16732) was already present in the upstream Spring Framework release 5.1.13.RELEASE before TuxCare onboarded it on 2026-10-25. The fix allows administrators to disable selector expression parsin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.1.13.RELEASE is NOT vulnerable to CVE-2018-1258. The vulnerability affected version 5.0.5 where JDK dynamic proxy beans could bypass Spring Security method-level authorization due to incorrect annotation matching on proxy classes. The upstream fix (commit aa11721ff0 by jhoeller@pivotal.io, April 2018) was already present in Spring Framework 5.1.13.RELEASE when TuxCare onboarded it. Both critical files (AnnotationMethodMatcher.java and AopUtils.java) contain the defensive proxy class checks that prevent the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.1.13.RELEASE is NOT vulnerable to CVE-2018-1258. The vulnerability affected version 5.0.5 where JDK dynamic proxy beans could bypass Spring Security method-level authorization due to incorrect annotation matching on proxy classes. The upstream fix (commit aa11721ff0 by jhoeller@pivotal.io, April 2018) was already present in Spring Framework 5.1.13.RELEASE when TuxCare onboarded it. Both critical files (AnnotationMethodMatcher.java and AopUtils.java) contain the defensive proxy class checks that prevent the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 5.1.13.RELEASE. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The fix for this Windows directory traversal vulnerability was implemented in upstream Spring Framework commits 0e28bee0f1 and 13356a7ee2 (SPR-16616) by Rossen Stoyanchev, and was already present in the upstream 5.1.13.RELEASE when TuxCare onboarded it...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 5.1.13.RELEASE. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The fix for this Windows directory traversal vulnerability was implemented in upstream Spring Framework commits 0e28bee0f1 and 13356a7ee2 (SPR-16616) by Rossen Stoyanchev, and was already present in the upstream 5.1.13.RELEASE when TuxCare onboarded it..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:46:12.447284+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 involves predictable multipart boundary generation that allows attackers to inject malicious parts. The vulnerability existed when Spring Framework used `new Random()` for boundary generation in MimeTypeUtils. The target version 5.1.13.RELEASE is not affected because the fix (using SecureRandom) was already present in the upstream release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 involves predictable multipart boundary generation that allows attackers to inject malicious parts. The vulnerability existed when Spring Framework used `new Random()` for boundary generation in MimeTypeUtils. The target version 5.1.13.RELEASE is not affected because the fix (using SecureRandom) was already present in the upstream release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:47:16.155569+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 does not affect this target. The upstream vendor fix (commit 423aa28e by Rossen Stoyanchev @ Pivotal) was already present in Spring Framework 5.1.13.RELEASE when TuxCare onboarded it. Both required defenses are present in HttpRange.java: (1) MAX_RANGES=100 limit rejects requests with >100 ranges at parse time, and (2) total byte count validation rejects overlapping/wide ranges whose sum >= resource length. These defenses are reachable on all affected code paths (static resource serving via ResourceHttpRequestHandler and controllers returning Resource via AbstractMessageConverterMethodProcessor).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 does not affect this target. The upstream vendor fix (commit 423aa28e by Rossen Stoyanchev @ Pivotal) was already present in Spring Framework 5.1.13.RELEASE when TuxCare onboarded it. Both required defenses are present in HttpRange.java: (1) MAX_RANGES=100 limit rejects requests with >100 ranges at parse time, and (2) total byte count validation rejects overlapping/wide ranges whose sum >= resource length. These defenses are reachable on all affected code paths (static resource serving via ResourceHttpRequestHandler and controllers returning Resource via AbstractMessageConverterMethodProcessor).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:25:00.091559+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124 and :142, request handling and CORS lookup directly iterate handler mappings without any cached-URI comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124 and :142, request handling and CORS lookup directly iterate handler mappings without any cached-URI comparison."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.13.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.1.13.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}