{
  "@id": "urn:uuid:84340966-44d8-47f8-8ff6-1aa3d1962b1e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 46,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:22:17.110385+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T11:54:20.614633+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6. While Spring Framework 5.1.5.RELEASE retains code that deserializes and compiles regex patterns (JdkRegexpMethodPointcut), the underlying JDK vulnerability was fixed in JDK 1.6 (2006). The target requires Java 8+ to build and run (build.gradle lines 105-106), so the vulnerable...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6. While Spring Framework 5.1.5.RELEASE retains code that deserializes and compiles regex patterns (JdkRegexpMethodPointcut), the underlying JDK vulnerability was fixed in JDK 1.6 (2006). The target requires Java 8+ to build and run (build.gradle lines 105-106), so the vulnerable..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-06T17:27:46.722408+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.5.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.5.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T09:31:48.808270+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.5.RELEASE is not affected by CVE-2011-2894. The vulnerability concerns unsafe deserialization of Java proxy classes allowing arbitrary code execution via malicious InvocationHandlers. The fix was introduced by upstream Spring maintainer Juergen Hoeller in commit 7d8aa05c407 on July 21, 2011, adding an acceptProxyClasses flag to ConfigurableObjectInputStream that blocks prox...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.5.RELEASE is not affected by CVE-2011-2894. The vulnerability concerns unsafe deserialization of Java proxy classes allowing arbitrary code execution via malicious InvocationHandlers. The fix was introduced by upstream Spring maintainer Juergen Hoeller in commit 7d8aa05c407 on July 21, 2011, adding an acceptProxyClasses flag to ConfigurableObjectInputStream that blocks prox..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in Spring Framework 5.1.5.RELEASE. The vulnerability was fixed by upstream vendor (Pivotal) in commit 8ee4651038 (May 2014) which was included in the 5.1.5.RELEASE before TuxCare onboarded it. The fix validates URI scheme prefixes to prevent path traversal via crafted URLs like `/a/:b/../../file`.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is not present in Spring Framework 5.1.5.RELEASE. The vulnerability was fixed by upstream vendor (Pivotal) in commit 8ee4651038 (May 2014) which was included in the 5.1.5.RELEASE before TuxCare onboarded it. The fix validates URI scheme prefixes to prevent path traversal via crafted URLs like `/a/:b/../../file`."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T19:04:00.051306+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed by upstream commit 52b8f34468 (SPR-12658) on Jan 22, 2015, which replaced AlternativeJdkIdGenerator with JdkIdGenerator. The fix uses UUID.randomUUID() for cryptographically secure random session IDs instead of the predictable Random-based ge...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affected Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed by upstream commit 52b8f34468 (SPR-12658) on Jan 22, 2015, which replaced AlternativeJdkIdGenerator with JdkIdGenerator. The fix uses UUID.randomUUID() for cryptographically secure random session IDs instead of the predictable Random-based ge..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:52:53.936815+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.1.5.RELEASE. The upstream fix was committed on 2015-10-04 (commit 2bd1daa75e \"Protect against RFD exploits\") and was already included in the Spring Framework 5.1.5.RELEASE when it was released in February 2019. The target contains the complete RFD defense: AbstractMessageConverterMethodProcessor.addContentDispositionHeader() validates file extensions in request URIs and adds a Content-Disposition header with a safe filename (f.txt) when non-whitelisted extensions are detected. This prevents browsers from executing downloaded content with dangerous extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.1.5.RELEASE. The upstream fix was committed on 2015-10-04 (commit 2bd1daa75e \"Protect against RFD exploits\") and was already included in the Spring Framework 5.1.5.RELEASE when it was released in February 2019. The target contains the complete RFD defense: AbstractMessageConverterMethodProcessor.addContentDispositionHeader() validates file extensions in request URIs and adds a Content-Disposition header with a safe filename (f.txt) when non-whitelisted extensions are detected. This prevents browsers from executing downloaded content with dangerous extensions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:04:07.366670+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. Spring Framework 5.1.5.RELEASE is NOT affected by CVE-2016-5007. The vulnerability affected versions 3.2.x, 4.0.x, 4.1.x, and 4.2.x which lacked an API for Spring Security to use Spring MVC's pattern matching logic. The fix (HandlerMappingIntrospector API with MatchableHandlerMapping interface) was introduced in Spring 4.3.1 by upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 (author: rstoyanchev@pivotal.io). This fix was already present in the upstream 5.1.5.RELEASE when TuxCare onboarded the repository. The target contains the complete defense: MatchableHandlerMapping interface, HandlerMappingIntrospector helper class, and implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping that expose their pattern matching logic via the match() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.1.5.RELEASE is NOT affected by CVE-2016-5007. The vulnerability affected versions 3.2.x, 4.0.x, 4.1.x, and 4.2.x which lacked an API for Spring Security to use Spring MVC's pattern matching logic. The fix (HandlerMappingIntrospector API with MatchableHandlerMapping interface) was introduced in Spring 4.3.1 by upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 (author: rstoyanchev@pivotal.io). This fix was already present in the upstream 5.1.5.RELEASE when TuxCare onboarded the repository. The target contains the complete defense: MatchableHandlerMapping interface, HandlerMappingIntrospector helper class, and implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping that expose their pattern matching logic via the match() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:48:02.040973+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. Spring Framework 5.1.5.RELEASE is not affected by CVE-2018-11040. The vulnerable JSONP support was completely removed in the upstream 5.1.x line (commit ac37b678a3, shipped in 5.1.0.RC1) before TuxCare onboarding. The target repository contains no JSONP-related code - no MappingJackson2JsonView.jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, and no JSONP transport handlers. The fix was authored by upstream Spring developer Sebastien Deleuze (sdeleuze@pivotal.io) on 2018-06-07.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.1.5.RELEASE is not affected by CVE-2018-11040. The vulnerable JSONP support was completely removed in the upstream 5.1.x line (commit ac37b678a3, shipped in 5.1.0.RC1) before TuxCare onboarding. The target repository contains no JSONP-related code - no MappingJackson2JsonView.jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, and no JSONP transport handlers. The fix was authored by upstream Spring developer Sebastien Deleuze (sdeleuze@pivotal.io) on 2018-06-07.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T00:51:08.182795+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3, allowing attackers to bypass security constraints through URL path parameters and special character encodings. The target repository is Spring Framework 5.1.5.RELEASE-tuxcare.7, which already contains the upstream fix (SPR-16616) that was shipped in v5.0.5.RELEASE. The fix includes path normalization (removing du...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3, allowing attackers to bypass security constraints through URL path parameters and special character encodings. The target repository is Spring Framework 5.1.5.RELEASE-tuxcare.7, which already contains the upstream fix (SPR-16616) that was shipped in v5.0.5.RELEASE. The fix includes path normalization (removing du..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T08:49:57.907521+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target is Spring Framework 5.1.5.RELEASE-tuxcare.6, which is a later version that already contains the upstream fix. The fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 16, 2018) shipped in upstream 5.1.5.RELEASE (February 13, 2019) before TuxCare onboarding. The target code contains the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target is Spring Framework 5.1.5.RELEASE-tuxcare.6, which is a later version that already contains the upstream fix. The fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 16, 2018) shipped in upstream 5.1.5.RELEASE (February 13, 2019) before TuxCare onboarding. The target code contains the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 with an authorization bypass in method security due to incorrect method resolution for proxy classes. The target version 5.1.5.RELEASE is not affected because the upstream fix (commits aa11721ff0 and eaff2c28a7 by Juergen Hoeller) was already shipped in the upstream release before TuxCare onboarded it. All fix components are present: AopUtils.getMostSpecificMethod() correctly processes proxy classes, CacheAspectSupport and ApplicationListenerMethodAdapter use correct target method resolution, and AnnotationMethodMatcher has early return for proxy classes. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 with an authorization bypass in method security due to incorrect method resolution for proxy classes. The target version 5.1.5.RELEASE is not affected because the upstream fix (commits aa11721ff0 and eaff2c28a7 by Juergen Hoeller) was already shipped in the upstream release before TuxCare onboarded it. All fix components are present: AopUtils.getMostSpecificMethod() correctly processes proxy classes, CacheAspectSupport and ApplicationListenerMethodAdapter use correct target method resolution, and AnnotationMethodMatcher has early return for proxy classes. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T18:15:01.892768+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.5.RELEASE is not affected by CVE-2018-1271. The directory traversal vulnerability was fixed in upstream Spring Framework releases (5.0.5+ and 4.3.15+), and the fix (commit 91b803a231) was already present in the 5.1.5.RELEASE version when TuxCare onboarded it. The target contains complete defenses: URL-encoded path validation that rejects paths containing `../` or `..\\` afte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.5.RELEASE is not affected by CVE-2018-1271. The directory traversal vulnerability was fixed in upstream Spring Framework releases (5.0.5+ and 4.3.15+), and the fix (commit 91b803a231) was already present in the 5.1.5.RELEASE version when TuxCare onboarded it. The target contains complete defenses: URL-encoded path validation that rejects paths containing `../` or `..\\` afte..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. CVE-2018-1272 is not present in Spring Framework 5.1.5.RELEASE. The vulnerability concerns predictable multipart boundary generation using weak Random, allowing attackers to inject extra multipart sections. The fix (commit ab2410c754, March 2018) changed MimeTypeUtils to use SecureRandom instead of Random for boundary generation. This fix was authored by upstream Spring developers (rstoyanchev@pivotal.io) and was already present in the 5.1.5.RELEASE when TuxCare onboarded it. A subsequent optimization (commit 847202c8f8, June 2018) added lazy initialization of SecureRandom, also from upstream. The target version is newer than the affected versions (5.0 < 5.0.5, 4.3 < 4.3.15) and contains the complete upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is not present in Spring Framework 5.1.5.RELEASE. The vulnerability concerns predictable multipart boundary generation using weak Random, allowing attackers to inject extra multipart sections. The fix (commit ab2410c754, March 2018) changed MimeTypeUtils to use SecureRandom instead of Random for boundary generation. This fix was authored by upstream Spring developers (rstoyanchev@pivotal.io) and was already present in the 5.1.5.RELEASE when TuxCare onboarded it. A subsequent optimization (commit 847202c8f8, June 2018) added lazy initialization of SecureRandom, also from upstream. The target version is newer than the affected versions (5.0 < 5.0.5, 4.3 < 4.3.15) and contains the complete upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:30:30.768655+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. The target Spring Framework 5.1.5.RELEASE-tuxcare.6 is NOT AFFECTED by CVE-2018-15756. The upstream fix (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e, authored by Rossen Stoyanchev on 2018-10-03) was already included in the upstream v5.1.5.RELEASE tag that TuxCare onboarded. The fix adds two critical validations to HttpRange.java: (1) MAX_RANGES=100 limit to prevent excessive range count, and (2) sum-of-ranges validation to prevent overlapping ranges from exceeding resource length. Both protections are present in the target code at lines 48 and 195-201.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 5.1.5.RELEASE-tuxcare.6 is NOT AFFECTED by CVE-2018-15756. The upstream fix (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e, authored by Rossen Stoyanchev on 2018-10-03) was already included in the upstream v5.1.5.RELEASE tag that TuxCare onboarded. The fix adds two critical validations to HttpRange.java: (1) MAX_RANGES=100 limit to prevent excessive range count, and (2) sum-of-ranges validation to prevent overlapping ranges from exceeding resource length. Both protections are present in the target code at lines 48 and 195-201.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-27T13:32:45.989372+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:17.110385+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI regular-expression matching mechanism is absent. Handler lookups iterate mappings directly without a URI cache in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:123, and the class ends without a CachedResult implementation at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:212.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI regular-expression matching mechanism is absent. Handler lookups iterate mappings directly without a URI cache in spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:123, and the class ends without a CachedResult implementation at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:212."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-27T13:32:45.989372+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.5.RELEASE-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-27T13:32:45.989372+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}