{ "@id": "urn:uuid:94dd345d-346c-41ef-919c-f3ea92ae0296", "role": "Document Creator", "author": "https://tuxcare.com", "version": 48, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:23:42.223331+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T12:31:00.165767+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.15.RELEASE is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile() in JDK versions before 1.6. Spring Framework 5.2.15 requires JDK 8+ as its baseline (documented in overview.adoc), and therefore cannot run on the vulnerable JDK versions. The CVE's affected Spring version range (1.1.0-2.5.6 and 3.0.0....", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 Spring Framework 5.2.15.RELEASE is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile() in JDK versions before 1.6. Spring Framework 5.2.15 requires JDK 8+ as its baseline (documented in overview.adoc), and therefore cannot run on the vulnerable JDK versions. The CVE's affected Spring version range (1.1.0-2.5.6 and 3.0.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-06T17:34:53.399896+00:00", "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.15.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2730" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.15.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T09:45:17.985105+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 is not a vulnerability in this version. The acceptProxyClasses security fix was introduced by upstream Spring Framework maintainer Juergen Hoeller in July 2011 (commit 070a723e) and shipped in Spring Framework 3.0.6. This fix is present in Spring Framework 5.2.15.RELEASE, which TuxCare onboarded. The defense mechanism exists in ConfigurableObjectInputStream.resolveProxyClass() whi...", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 CVE-2011-2894 is not a vulnerability in this version. The acceptProxyClasses security fix was introduced by upstream Spring Framework maintainer Juergen Hoeller in July 2011 (commit 070a723e) and shipped in Spring Framework 3.0.6. This fix is present in Spring Framework 5.2.15.RELEASE, which TuxCare onboarded. The defense mechanism exists in ConfigurableObjectInputStream.resolveProxyClass() whi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-02T17:10:00.096270+00:00", "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.2.15.RELEASE-tuxcare.3. The fix was already included in the upstream release 5.2.15.RELEASE, applied by upstream developer Rossen Stoyanchev (rstoyanchev@gopivotal.com) in commit 8ee4651038 on 2014-05-15, years before TuxCare onboarded this version. The vulnerable code pattern (unconditional preservation of URI...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3578" }, "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 5.2.15.RELEASE-tuxcare.3. The fix was already included in the upstream release 5.2.15.RELEASE, applied by upstream developer Rossen Stoyanchev (rstoyanchev@gopivotal.com) in commit 8ee4651038 on 2014-05-15, years before TuxCare onboarded this version. The vulnerable code pattern (unconditional preservation of URI..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T19:13:01.149696+00:00", "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client used a predictable pseudo-random number generator (AlternativeJdkIdGenerator) for session ID generation. The target version 5.2.15.RELEASE already contains the upstream fix (commit 52b8f34468) introduced in Spring Framework 4.1.5 that replaced the vulnerable generator with JdkIdGenerator, which uses cryptogr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-0201" }, "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client used a predictable pseudo-random number generator (AlternativeJdkIdGenerator) for session ID generation. The target version 5.2.15.RELEASE already contains the upstream fix (commit 52b8f34468) introduced in Spring Framework 4.1.5 that replaced the vulnerable generator with JdkIdGenerator, which uses cryptogr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T13:01:12.948527+00:00", "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download) is not present in Spring Framework 5.2.15.RELEASE. The upstream vendor fix (commit 2bd1daa75e by Rossen Stoyanchev) was already included in this release before TuxCare onboarding. The RFD protection mechanisms are active: addContentDispositionHeader method validates file extensions in request URIs and path parameters, adding Content-Disposition headers for unsafe extensions. Additionally, JSONP support (another RFD vector) was completely removed upstream in commit ac37b678a3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-5211" }, "impact_statement": "CVE-2015-5211 (Reflected File Download) is not present in Spring Framework 5.2.15.RELEASE. The upstream vendor fix (commit 2bd1daa75e by Rossen Stoyanchev) was already included in this release before TuxCare onboarding. The RFD protection mechanisms are active: addContentDispositionHeader method validates file extensions in request URIs and path parameters, adding Content-Disposition headers for unsafe extensions. Additionally, JSONP support (another RFD vector) was completely removed upstream in commit ac37b678a3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T13:14:44.515379+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.2.15.RELEASE. The fix (HandlerMappingIntrospector introspection API and MatchableHandlerMapping interface) was introduced in upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by Rossen Stoyanchev on April 25, 2016. This commit is part of the upstream 5.2.15.RELEASE that TuxCare onboarded, meaning the vulnerable pattern never existed in this target version. The fix provides an API that allows Spring Security to use Spring Framework's exact pattern-matching logic, eliminating the authorization bypass risk from pattern-matching discrepancies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.2.15.RELEASE. The fix (HandlerMappingIntrospector introspection API and MatchableHandlerMapping interface) was introduced in upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by Rossen Stoyanchev on April 25, 2016. This commit is part of the upstream 5.2.15.RELEASE that TuxCare onboarded, meaning the vulnerable pattern never existed in this target version. The fix provides an API that allows Spring Security to use Spring Framework's exact pattern-matching logic, eliminating the authorization bypass risk from pattern-matching discrepancies.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T13:56:28.350475+00:00", "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-11040 does not affect Spring Framework 5.2.15.RELEASE. The vulnerable JSONP functionality has been completely removed from the codebase. The CVE concerns automatic JSONP enablement in MappingJackson2JsonView via \"jsonp\" and \"callback\" query parameters, but all JSONP-related code (jsonpParameterNames field, setJsonpParameterNames method, JSONP parameter validation) has been removed in the upstream release that TuxCare onboarded. The removal was performed by upstream Spring Framework (commit ac37b678a3 by sdeleuze@pivotal.io) and was already present in 5.2.15.RELEASE before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11040" }, "impact_statement": "CVE-2018-11040 does not affect Spring Framework 5.2.15.RELEASE. The vulnerable JSONP functionality has been completely removed from the codebase. The CVE concerns automatic JSONP enablement in MappingJackson2JsonView via \"jsonp\" and \"callback\" query parameters, but all JSONP-related code (jsonpParameterNames field, setJsonpParameterNames method, JSONP parameter validation) has been removed in the upstream release that TuxCare onboarded. The removal was performed by upstream Spring Framework (commit ac37b678a3 by sdeleuze@pivotal.io) and was already present in 5.2.15.RELEASE before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T01:05:00.128546+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.2.15.RELEASE. The vulnerability (path traversal via specially encoded URL path parameters) was fixed by upstream Spring Framework before the 5.2.15.RELEASE version that TuxCare onboarded. All three defense mechanisms are present: (1) path normalization converting backslashes to forward slashes and removing duplicate slashes, (2) encoded path tr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.2.15.RELEASE. The vulnerability (path traversal via specially encoded URL path parameters) was fixed by upstream Spring Framework before the 5.2.15.RELEASE version that TuxCare onboarded. All three defense mechanisms are present: (1) path normalization converting backslashes to forward slashes and removing duplicate slashes, (2) encoded path tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.2.15.RELEASE is not affected by CVE-2018-1257. The vulnerability (inability to disable selector header processing in STOMP WebSocket subscriptions, allowing ReDoS attacks via malicious Spring EL expressions) was fixed in upstream Spring Framework 5.0.6 and 4.3.17 (April 2018). The fix was already present in the upstream 5.2.15.RELEASE that TuxCare onboarded. The fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1257" }, "impact_statement": "not_affected \u2014 The target Spring Framework 5.2.15.RELEASE is not affected by CVE-2018-1257. The vulnerability (inability to disable selector header processing in STOMP WebSocket subscriptions, allowing ReDoS attacks via malicious Spring EL expressions) was fixed in upstream Spring Framework 5.0.6 and 4.3.17 (April 2018). The fix was already present in the upstream 5.2.15.RELEASE that TuxCare onboarded. The fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 is NOT present in Spring Framework 5.2.15.RELEASE-tuxcare.3. The vulnerability (authorization bypass due to improper method resolution for JDK dynamic proxy classes) was fixed in upstream Spring Framework by commits aa11721ff0 and eaff2c28a7 (April 2018), which were already present in the upstream 5.2.15.RELEASE when TuxCare onboarded it. The fix ensures that security annotations are properly discovered on proxied methods by correcting method resolution logic in AopUtils.getMostSpecificMethod() and adding explicit proxy class handling in AnnotationMethodMatcher.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1258" }, "impact_statement": "CVE-2018-1258 is NOT present in Spring Framework 5.2.15.RELEASE-tuxcare.3. The vulnerability (authorization bypass due to improper method resolution for JDK dynamic proxy classes) was fixed in upstream Spring Framework by commits aa11721ff0 and eaff2c28a7 (April 2018), which were already present in the upstream 5.2.15.RELEASE when TuxCare onboarded it. The fix ensures that security annotations are properly discovered on proxied methods by correcting method resolution logic in AopUtils.getMostSpecificMethod() and adding explicit proxy class handling in AnnotationMethodMatcher.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T18:46:00.154894+00:00", "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.2.15.RELEASE. The fix (adding `isInvalidEncodedPath` method that decodes URL-encoded paths and rejects traversal patterns `../` and `..\\\\`) was authored by upstream developer rstoyanchev@pivotal.io in commit 0e28bee0f1 and was already included in the upstream 5.2.15.RELEASE before TuxCare onboarding. All four a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1271" }, "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.2.15.RELEASE. The fix (adding `isInvalidEncodedPath` method that decodes URL-encoded paths and rejects traversal patterns `../` and `..\\\\`) was authored by upstream developer rstoyanchev@pivotal.io in commit 0e28bee0f1 and was already included in the upstream 5.2.15.RELEASE before TuxCare onboarding. All four a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T12:24:19.585233+00:00", "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework's multipart boundary generation when using weak random number generation. The vulnerability allowed attackers to predict boundaries and inject malicious multipart sections, potentially leading to privilege escalation. Target version 5.2.15.RELEASE contains the upstream fix (commit ab2410c754) that replaced java.util.Random with SecureRandom in MimeTypeUtils.generateMultipartBoundary(). The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) on 2018-03-23 and shipped in the upstream 5.2.15.RELEASE, before TuxCare's onboarding on 2026-09-07. All multipart boundary generation in the codebase delegates to MimeTypeUtils, confirming comprehensive protection. Verdict: not_affected (vulnerable pattern not present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1272" }, "impact_statement": "CVE-2018-1272 affects Spring Framework's multipart boundary generation when using weak random number generation. The vulnerability allowed attackers to predict boundaries and inject malicious multipart sections, potentially leading to privilege escalation. Target version 5.2.15.RELEASE contains the upstream fix (commit ab2410c754) that replaced java.util.Random with SecureRandom in MimeTypeUtils.generateMultipartBoundary(). The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) on 2018-03-23 and shipped in the upstream 5.2.15.RELEASE, before TuxCare's onboarding on 2026-09-07. All multipart boundary generation in the codebase delegates to MimeTypeUtils, confirming comprehensive protection. Verdict: not_affected (vulnerable pattern not present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-03T13:39:12.146709+00:00", "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.2.15.RELEASE. The vulnerability (HTTP Range DoS via excessive range count or overlapping ranges) was fixed in upstream commits 423aa28ed58 (Oct 2018) and da557e7415 (Apr 2019), both of which are ancestors of the upstream v5.2.15.RELEASE tag. The fix adds MAX_RANGES=100 validation and sum-of-ranges validation. TuxCare onboarded the already-fixed version (commit 41a7f7e085 \"Onboard version 5.2.15.RELEASE\" by amoniatovskiy@cloudlinux.com), so no TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15756" }, "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.2.15.RELEASE. The vulnerability (HTTP Range DoS via excessive range count or overlapping ranges) was fixed in upstream commits 423aa28ed58 (Oct 2018) and da557e7415 (Apr 2019), both of which are ancestors of the upstream v5.2.15.RELEASE tag. The fix adds MAX_RANGES=100 validation and sum-of-ranges validation. TuxCare onboarded the already-fixed version (commit 41a7f7e085 \"Onboard version 5.2.15.RELEASE\" by amoniatovskiy@cloudlinux.com), so no TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-21T16:53:20.690668+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-05T16:24:00.036966+00:00", "status_notes": "Vulnerability CVE-2021-22096 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.15.RELEASE-tuxcare.4.", "vulnerability": { "name": "CVE-2021-22096" }, "action_statement": "Vulnerability CVE-2021-22096 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.15.RELEASE-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-10T04:23:42.223331+00:00", "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because HandlerMappingIntrospector has no CachedResult or vulnerable URI comparison that treats a supplied request URI as a regular expression. Its matching entry point directly iterates handler mappings without accessing cached results (spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2024-22233" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because HandlerMappingIntrospector has no CachedResult or vulnerable URI comparison that treats a supplied request URI as a regular expression. Its matching entry point directly iterates handler mappings without accessing cached results (spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:124)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-21T16:53:20.690668+00:00", "status_notes": "Vulnerability CVE-2025-41249 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core.", "vulnerability": { "name": "CVE-2025-41249" }, "action_statement": "Vulnerability CVE-2025-41249 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-core@5.2.15.RELEASE-tuxcare.2" } } ], "timestamp": "2026-11-05T16:24:00.036966+00:00", "status_notes": "Vulnerability CVE-2026-41848 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.15.RELEASE-tuxcare.4.", "vulnerability": { "name": "CVE-2026-41848" }, "action_statement": "Vulnerability CVE-2026-41848 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.15.RELEASE-tuxcare.4." } ] }