{
  "@id": "urn:uuid:50904f14-730d-4949-8837-c9757f5383b6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:23:42.223331+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:17:00.086490+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.3.RELEASE is not affected by CVE-2009-1190. While the code pattern that compiles regex patterns from strings exists (UriTemplate line 238), the underlying JDK vulnerability is the root cause. CVE-2009-1190 describes an algorithmic complexity bug in java.util.regex.Pattern.compile that was fixed in JDK 1.6. Spring 5.1.3 requires Java 8 (verified via sourceCompatibility=1.8 i...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.3.RELEASE is not affected by CVE-2009-1190. While the code pattern that compiles regex patterns from strings exists (UriTemplate line 238), the underlying JDK vulnerability is the root cause. CVE-2009-1190 describes an algorithmic complexity bug in java.util.regex.Pattern.compile that was fixed in JDK 1.6. Spring 5.1.3 requires Java 8 (verified via sourceCompatibility=1.8 i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T17:35:48.716738+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.3.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.3.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T09:45:17.985105+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 is not present in Spring Framework 5.1.3.RELEASE-tuxcare.4. The vulnerability affected versions 3.0.0-3.0.5 and exploited the absence of any mechanism to reject proxy class deserialization. The upstream fix (commit 070a723ef2 by Juergen Hoeller, July 2011) added an acceptProxyClasses configuration flag that allows administrators to block proxy deserialization by setting it to fals...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is not present in Spring Framework 5.1.3.RELEASE-tuxcare.4. The vulnerability affected versions 3.0.0-3.0.5 and exploited the absence of any mechanism to reject proxy class deserialization. The upstream fix (commit 070a723ef2 by Juergen Hoeller, July 2011) added an acceptProxyClasses configuration flag that allows administrators to block proxy deserialization by setting it to fals..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:17:00.086490+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target is version 5.1.3.RELEASE (released 2018), significantly newer than the fixed versions. The vulnerability involved StringUtils.cleanPath incorrectly treating path components with embedded colons (e.g., /a/:b/) as URI scheme prefixes, breaking path traversal normalization and allowing directory traversal atta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target is version 5.1.3.RELEASE (released 2018), significantly newer than the fixed versions. The vulnerability involved StringUtils.cleanPath incorrectly treating path components with embedded colons (e.g., /a/:b/) as URI scheme prefixes, breaking path traversal normalization and allowing directory traversal atta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:13:01.149696+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in upstream Spring Framework 4.1.5 (commit 52b8f34468, January 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator. The target version 5.1.3.RELEASE already contains this upstream fix - it uses JdkIdGenerator which calls UUID.rand...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in upstream Spring Framework 4.1.5 (commit 52b8f34468, January 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator. The target version 5.1.3.RELEASE already contains this upstream fix - it uses JdkIdGenerator which calls UUID.rand..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is not present in Spring Framework 5.1.3.RELEASE. The fix was already included in the upstream release before TuxCare onboarding. The target contains the addContentDispositionHeader defense mechanism that checks URL file extensions against a whitelist and adds a Content-Disposition header with a safe filename when dangerous extensions are detected, preventing RFD exploits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is not present in Spring Framework 5.1.3.RELEASE. The fix was already included in the upstream release before TuxCare onboarding. The target contains the addContentDispositionHeader defense mechanism that checks URL file extensions against a whitelist and adds a Content-Disposition header with a safe filename when dangerous extensions are detected, preventing RFD exploits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:14:44.515379+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2016-5007 describes pattern matching inconsistencies between Spring Security (for authorization) and Spring Framework (for request routing) that could lead to authorization bypass. The upstream fix (commit a30ab30e4e, April 2016) introduced the HandlerMappingIntrospector API and MatchableHandlerMapping interface, allowing Spring Security to use identical pattern matching logic as the Framework's HandlerMappings. The target version (5.1.3.RELEASE) was released in November 2018 and includes this fix as part of the upstream release. The vulnerable pattern (absence of introspection API) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 describes pattern matching inconsistencies between Spring Security (for authorization) and Spring Framework (for request routing) that could lead to authorization bypass. The upstream fix (commit a30ab30e4e, April 2016) introduced the HandlerMappingIntrospector API and MatchableHandlerMapping interface, allowing Spring Security to use identical pattern matching logic as the Framework's HandlerMappings. The target version (5.1.3.RELEASE) was released in November 2018 and includes this fix as part of the upstream release. The vulnerable pattern (absence of introspection API) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:57:09.327261+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2018-11040 concerns automatic JSONP support in Spring Framework that enabled cross-domain requests via query parameters \"jsonp\" or \"callback\". The target version 5.1.3.RELEASE is not affected because JSONP support was completely removed from the Spring Framework codebase in upstream commit ac37b678a3 (2018-06-07) by Sebastien Deleuze, prior to the 5.1.3.RELEASE (2018-11-27). The vulnerable code patterns (MappingJackson2JsonView.jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, JsonpPollingTransportHandler, JsonpReceivingTransportHandler, and all JSONP-related methods) do not exist in this version. TuxCare onboarded the upstream v5.1.3.RELEASE which already had JSONP removed. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 concerns automatic JSONP support in Spring Framework that enabled cross-domain requests via query parameters \"jsonp\" or \"callback\". The target version 5.1.3.RELEASE is not affected because JSONP support was completely removed from the Spring Framework codebase in upstream commit ac37b678a3 (2018-06-07) by Sebastien Deleuze, prior to the 5.1.3.RELEASE (2018-11-27). The vulnerable code patterns (MappingJackson2JsonView.jsonpParameterNames field, AbstractJsonpResponseBodyAdvice class, JsonpPollingTransportHandler, JsonpReceivingTransportHandler, and all JSONP-related methods) do not exist in this version. TuxCare onboarded the upstream v5.1.3.RELEASE which already had JSONP removed. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T01:06:00.110833+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.1.3.RELEASE-tuxcare.4 is not affected by CVE-2018-1199. All defensive mechanisms from the upstream patches (path normalization, duplicate slash removal, encoded traversal detection) were already present in the upstream 5.1.3.RELEASE before TuxCare onboarded it. The vulnerability affected versions before 4.3.14 and 5.0.3; version 5.1.3 (released December 2018) natur...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.1.3.RELEASE-tuxcare.4 is not affected by CVE-2018-1199. All defensive mechanisms from the upstream patches (path normalization, duplicate slash removal, encoded traversal detection) were already present in the upstream 5.1.3.RELEASE before TuxCare onboarded it. The vulnerability affected versions before 4.3.14 and 5.0.3; version 5.1.3 (released December 2018) natur..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:17:00.086490+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.3.RELEASE is not affected by CVE-2018-1257. The vulnerability affects versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The fix (commit ff2228fdaf, SPR-16732) was committed to upstream Spring Framework on April 16, 2018, and was included in the upstream 5.1.3.RELEASE (released January 9, 2019). The target repository's v5.1.3.RELEASE tag contains the upstream fix, and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.3.RELEASE is not affected by CVE-2018-1257. The vulnerability affects versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The fix (commit ff2228fdaf, SPR-16732) was committed to upstream Spring Framework on April 16, 2018, and was included in the upstream 5.1.3.RELEASE (released January 9, 2019). The target repository's v5.1.3.RELEASE tag contains the upstream fix, and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. Spring Framework 5.1.3.RELEASE is NOT vulnerable to CVE-2018-1258. The upstream release already contains the security fix (commit aa11721ff0 by Juergen Hoeller, 2018-04-27) that corrects method resolution for JDK dynamic proxies. The vulnerable pattern (the `!Proxy.isProxyClass(targetClass)` check that prevented proper method resolution and annotation detection on proxy classes) is not present in the target. This fix ensures Spring Security's method-level security annotations are properly enforced on proxied methods, preventing the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.1.3.RELEASE is NOT vulnerable to CVE-2018-1258. The upstream release already contains the security fix (commit aa11721ff0 by Juergen Hoeller, 2018-04-27) that corrects method resolution for JDK dynamic proxies. The vulnerable pattern (the `!Proxy.isProxyClass(targetClass)` check that prevented proper method resolution and annotation detection on proxy classes) is not present in the target. This fix ensures Spring Security's method-level security annotations are properly enforced on proxied methods, preventing the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:17:00.086490+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.1.3.RELEASE. The fix was already included in the upstream release when TuxCare onboarded it. The upstream vendor (Pivotal/Spring) fixed this vulnerability in March 2018 (commit 91b803a2310344d925e5d4b1709bbcea90375548), and Spring Framework 5.1.3.RELEASE was released in November 2018, already containing the com...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.1.3.RELEASE. The fix was already included in the upstream release when TuxCare onboarded it. The upstream vendor (Pivotal/Spring) fixed this vulnerability in March 2018 (commit 91b803a2310344d925e5d4b1709bbcea90375548), and Spring Framework 5.1.3.RELEASE was released in November 2018, already containing the com..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2018-1272 is not present in Spring Framework 5.1.3.RELEASE. The vulnerability involves predictable multipart boundary generation using java.util.Random, which allows attackers to inject additional multipart sections when a Spring application forwards client input as multipart requests to another server. The upstream fix (commit ab2410c754 by rstoyanchev@pivotal.io, March 2018) replaced Random with SecureRandom, first appearing in v5.0.5.RELEASE. Version 5.1.3.RELEASE, released after 5.0.5, already contains this fix plus a lazy initialization optimization (commit 847202c8f8). The target code at spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java:365 uses `new SecureRandom()` for boundary generation, making boundaries cryptographically unpredictable. This fix shipped in the upstream release before TuxCare onboarding (first TuxCare commit: 21efa7215b).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is not present in Spring Framework 5.1.3.RELEASE. The vulnerability involves predictable multipart boundary generation using java.util.Random, which allows attackers to inject additional multipart sections when a Spring application forwards client input as multipart requests to another server. The upstream fix (commit ab2410c754 by rstoyanchev@pivotal.io, March 2018) replaced Random with SecureRandom, first appearing in v5.0.5.RELEASE. Version 5.1.3.RELEASE, released after 5.0.5, already contains this fix plus a lazy initialization optimization (commit 847202c8f8). The target code at spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java:365 uses `new SecureRandom()` for boundary generation, making boundaries cryptographically unpredictable. This fix shipped in the upstream release before TuxCare onboarding (first TuxCare commit: 21efa7215b).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:39:52.216680+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. The target Spring Framework 5.1.3.RELEASE is NOT affected by CVE-2018-15756. The vulnerability (unbounded HTTP Range requests causing DoS) was fixed by the upstream Spring team in commit 423aa28ed5 (October 3, 2018) and shipped in Spring Framework 5.1.1.RELEASE. The target version 5.1.3.RELEASE (released December 2018) includes this upstream fix. The fix adds two protections: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges, and (2) validation that sum of all range byte-counts < resource length. Both protections are present in the target's HttpRange.java at lines 47-48, 147, and 195-201. This is an upstream vendor fix authored by rstoyanchev@pivotal.io, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 5.1.3.RELEASE is NOT affected by CVE-2018-15756. The vulnerability (unbounded HTTP Range requests causing DoS) was fixed by the upstream Spring team in commit 423aa28ed5 (October 3, 2018) and shipped in Spring Framework 5.1.1.RELEASE. The target version 5.1.3.RELEASE (released December 2018) includes this upstream fix. The fix adds two protections: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges, and (2) validation that sum of all range byte-counts < resource length. Both protections are present in the target's HttpRange.java at lines 47-48, 147, and 195-201. This is an upstream vendor fix authored by rstoyanchev@pivotal.io, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:17:00.086490+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:17:00.086490+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:23:42.223331+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison code is absent. spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:62 contains no CachedResult, cache filter, or cached-URI comparison. The lookup method in the same file at line 123 directly iterates handler mappings, skips null handlers, and returns null when none match.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison code is absent. spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:62 contains no CachedResult, cache filter, or cached-URI comparison. The lookup method in the same file at line 123 directly iterates handler mappings, skips null handlers, and returns null when none match."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:17:00.086490+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.3.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:17:00.086490+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.1.3.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}