{
  "@id": "urn:uuid:13850bcc-575a-4d3a-8e09-13d41833f0ca",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:25:00.091559+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.8.RELEASE is not affected by CVE-2009-1190. The vulnerability is an algorithmic complexity issue in the JDK's Pattern.compile method (JDK versions before 1.6). While Spring does deserialize and compile regex patterns without validation in JdkRegexpMethodPointcut, this version requires Java 8 (sourceCompatibility = 1.8), which is much newer than JDK 1.6 and includes the fix ...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.8.RELEASE is not affected by CVE-2009-1190. The vulnerability is an algorithmic complexity issue in the JDK's Pattern.compile method (JDK versions before 1.6). While Spring does deserialize and compile regex patterns without validation in JdkRegexpMethodPointcut, this version requires Java 8 (sourceCompatibility = 1.8), which is much newer than JDK 1.6 and includes the fix ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.8.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.1.8.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.1.8.RELEASE is not affected by CVE-2011-2894. The vulnerability affected Spring Framework 3.0.0 through 3.0.5 (released 2009-2011) and was fixed in upstream Spring Framework 3.0.6 in July 2011 via commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb by Juergen Hoeller. The fix introduced an `acceptProxyClasses` configuration flag that allows applications to reject proxy class dese...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.1.8.RELEASE is not affected by CVE-2011-2894. The vulnerability affected Spring Framework 3.0.0 through 3.0.5 (released 2009-2011) and was fixed in upstream Spring Framework 3.0.6 in July 2011 via commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb by Juergen Hoeller. The fix introduced an `acceptProxyClasses` configuration flag that allows applications to reject proxy class dese..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.1.8.RELEASE. The fix for this vulnerability (adding validation to reject path prefixes containing forward slashes in StringUtils.cleanPath()) was introduced by upstream in commit 8ee4651038 (May 2014, SPR-11793) and shipped in Spring Framework 3.2.9/4.0.5. This fix was already present in the upstream 5.1.8.RELE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.1.8.RELEASE. The fix for this vulnerability (adding validation to reject path prefixes containing forward slashes in StringUtils.cleanPath()) was introduced by upstream in commit 8ee4651038 (May 2014, SPR-11793) and shipped in Spring Framework 3.2.9/4.0.5. This fix was already present in the upstream 5.1.8.RELE..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client using AlternativeJdkIdGenerator (SecureRandom for initial seed only, then predictable java.util.Random). The target version 5.1.8.RELEASE is not affected because the fix (commit 52b8f34468 by upstream author Rossen Stoyanchev) was already present in the upstream release. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client using AlternativeJdkIdGenerator (SecureRandom for initial seed only, then predictable java.util.Random). The target version 5.1.8.RELEASE is not affected because the fix (commit 52b8f34468 by upstream author Rossen Stoyanchev) was already present in the upstream release. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download) is NOT present in Spring Framework 5.1.8.RELEASE. The RFD defense mechanism (addContentDispositionHeader method with extension whitelisting) was already included in the upstream release published by VMware/Pivotal. The fix commit 2bd1daa75e authored by rstoyanchev@pivotal.io is an ancestor of the TuxCare onboarding commit e26ff3dd1c, confirming this was an upstream fix shipped in the release, not a TuxCare backport. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download) is NOT present in Spring Framework 5.1.8.RELEASE. The RFD defense mechanism (addContentDispositionHeader method with extension whitelisting) was already included in the upstream release published by VMware/Pivotal. The fix commit 2bd1daa75e authored by rstoyanchev@pivotal.io is an ancestor of the TuxCare onboarding commit e26ff3dd1c, confirming this was an upstream fix shipped in the release, not a TuxCare backport. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2016-5007 describes pattern matching inconsistencies between Spring Security and Spring MVC that could allow authorization bypass. The target Spring Framework 5.1.8.RELEASE contains the fix: a HandlerMapping introspection API (MatchableHandlerMapping interface, HandlerMappingIntrospector helper) that exposes MVC's internal pattern matching logic to external authorization frameworks. This ensures both systems use identical PathMatcher instances and UrlPathHelper configuration, eliminating the inconsistency vulnerability. The fix (commit a30ab30e4e, April 2016) was authored by the upstream vendor (Pivotal/VMware) and shipped in Spring 4.3.1, well before 5.1.8.RELEASE was released in 2019.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 describes pattern matching inconsistencies between Spring Security and Spring MVC that could allow authorization bypass. The target Spring Framework 5.1.8.RELEASE contains the fix: a HandlerMapping introspection API (MatchableHandlerMapping interface, HandlerMappingIntrospector helper) that exposes MVC's internal pattern matching logic to external authorization frameworks. This ensures both systems use identical PathMatcher instances and UrlPathHelper configuration, eliminating the inconsistency vulnerability. The fix (commit a30ab30e4e, April 2016) was authored by the upstream vendor (Pivotal/VMware) and shipped in Spring 4.3.1, well before 5.1.8.RELEASE was released in 2019.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. Spring Framework 5.1.8.RELEASE is not affected by CVE-2018-11040 (JSONP cross-domain request vulnerability). The vulnerable JSONP support code was completely removed by upstream commit ac37b678a3 (author: Sebastien Deleuze <sdeleuze@pivotal.io>) on June 7, 2018, before the 5.1.8.RELEASE version was released. This removal was already present in the upstream release when TuxCare onboarded it (commit e26ff3dd1c). The target contains no JSONP parameter processing code, no callback wrapping logic, and no AbstractJsonpResponseBodyAdvice class. HTTP requests with \"jsonp\" or \"callback\" query parameters cannot trigger JSONP wrapping because the code to process these parameters does not exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.1.8.RELEASE is not affected by CVE-2018-11040 (JSONP cross-domain request vulnerability). The vulnerable JSONP support code was completely removed by upstream commit ac37b678a3 (author: Sebastien Deleuze <sdeleuze@pivotal.io>) on June 7, 2018, before the 5.1.8.RELEASE version was released. This removal was already present in the upstream release when TuxCare onboarded it (commit e26ff3dd1c). The target contains no JSONP parameter processing code, no callback wrapping logic, and no AbstractJsonpResponseBodyAdvice class. HTTP requests with \"jsonp\" or \"callback\" query parameters cannot trigger JSONP wrapping because the code to process these parameters does not exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 5.1.8.RELEASE. The vulnerability allowed attackers to bypass security constraints on static resources using URL path parameters with special encodings (e.g., duplicate slashes, backslashes, encoded traversal sequences). The upstream fix (SPR-16616) was applied in commits 0e28bee0f1 and 91b803a231 by Pivotal engineers before the 5.1.8.RELEASE tag....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 5.1.8.RELEASE. The vulnerability allowed attackers to bypass security constraints on static resources using URL path parameters with special encodings (e.g., duplicate slashes, backslashes, encoded traversal sequences). The upstream fix (SPR-16616) was applied in commits 0e28bee0f1 and 91b803a231 by Pivotal engineers before the 5.1.8.RELEASE tag...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target version 5.1.8.RELEASE is NOT in the affected version range. The vulnerability involved regex DoS attacks via malicious Spring EL expressions in STOMP subscription \"selector\" headers. The upstream fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 2018) added the ability to disable sel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target version 5.1.8.RELEASE is NOT in the affected version range. The vulnerability involved regex DoS attacks via malicious Spring EL expressions in STOMP subscription \"selector\" headers. The upstream fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 2018) added the ability to disable sel..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 due to incorrect method resolution on JDK dynamic proxies, causing security annotation bypass. The target version 5.1.8.RELEASE already contains the upstream fix (commits aa11721ff0 and eaff2c28a7 by jhoeller@pivotal.io, dated 2018-04-27) that was shipped in 5.1.0.RC1. The vulnerable pattern (skipping method resolution when Proxy.isProxyClass returns true) is not present in AopUtils.getMostSpecificMethod(), and the complementary fixes in CacheAspectSupport and ApplicationListenerMethodAdapter properly resolve target methods for proxy classes. No TuxCare backport is needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 due to incorrect method resolution on JDK dynamic proxies, causing security annotation bypass. The target version 5.1.8.RELEASE already contains the upstream fix (commits aa11721ff0 and eaff2c28a7 by jhoeller@pivotal.io, dated 2018-04-27) that was shipped in 5.1.0.RC1. The vulnerable pattern (skipping method resolution when Proxy.isProxyClass returns true) is not present in AopUtils.getMostSpecificMethod(), and the complementary fixes in CacheAspectSupport and ApplicationListenerMethodAdapter properly resolve target methods for proxy classes. No TuxCare backport is needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.1.8.RELEASE is not affected by CVE-2018-1271. The vulnerability (directory traversal via URL-encoded path sequences when serving static resources on Windows) was fixed in upstream Spring Framework 5.0.5 (March 2018) via SPR-16616. The fix was authored by upstream Spring maintainers (Juergen Hoeller, Rossen Stoyanchev from Pivotal) and was already present in the 5.1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.1.8.RELEASE is not affected by CVE-2018-1271. The vulnerability (directory traversal via URL-encoded path sequences when serving static resources on Windows) was fixed in upstream Spring Framework 5.0.5 (March 2018) via SPR-16616. The fix was authored by upstream Spring maintainers (Juergen Hoeller, Rossen Stoyanchev from Pivotal) and was already present in the 5.1..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. Target version 5.1.8.RELEASE is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using java.util.Random, which could allow attackers to inject malicious multipart parts into forwarded requests. The fix (using SecureRandom instead) was introduced by upstream Spring Framework commit ab2410c754 and was already present in the upstream 5.1.8.RELEASE when TuxCare onboarded it. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Target version 5.1.8.RELEASE is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using java.util.Random, which could allow attackers to inject malicious multipart parts into forwarded requests. The fix (using SecureRandom instead) was introduced by upstream Spring Framework commit ab2410c754 and was already present in the upstream 5.1.8.RELEASE when TuxCare onboarded it. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.1.8.RELEASE. The upstream fix (commit 423aa28e by Rossen Stoyanchev) was included in v5.1.1.RELEASE (Oct 2018), well before v5.1.8.RELEASE (June 2019). The target contains both required protections: MAX_RANGES=100 limit in parseRanges() and overlap validation in toResourceRegions(). This is an upstream-authored fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.1.8.RELEASE. The upstream fix (commit 423aa28e by Rossen Stoyanchev) was included in v5.1.1.RELEASE (Oct 2018), well before v5.1.8.RELEASE (June 2019). The target contains both required protections: MAX_RANGES=100 limit in parseRanges() and overlap validation in toResourceRegions(). This is an upstream-authored fix that shipped in the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:25:00.091559+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:123, the code wraps the request and directly iterates handler mappings; this implementation has no CachedResult class or cached-URI regular-expression comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:123, the code wraps the request and directly iterates handler mappings; this implementation has no CachedResult class or cached-URI regular-expression comparison."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.1.8.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:36:14.547191+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.1.8.RELEASE-tuxcare.3 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}