{
  "@id": "urn:uuid:d85c6015-38a3-40b4-9589-560a382e9399",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:34:53.399896+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.17.RELEASE is not affected by CVE-2009-1190 because the vulnerability requires JDK < 1.6 to exploit, but Spring 5.2.17 requires Java 8+ minimum. The algorithmic complexity vulnerability in java.util.regex.Pattern.compile was fixed in JDK 1.6, and modern JDKs (Java 8+) include this fix. While Spring's PatternEditor still calls Pattern.compile without validation (spring-beans...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.17.RELEASE is not affected by CVE-2009-1190 because the vulnerability requires JDK < 1.6 to exploit, but Spring 5.2.17 requires Java 8+ minimum. The algorithmic complexity vulnerability in java.util.regex.Pattern.compile was fixed in JDK 1.6, and modern JDKs (Java 8+) include this fix. While Spring's PatternEditor still calls Pattern.compile without validation (spring-beans..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T17:34:53.399896+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.17.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.17.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 is NOT present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The fix was already included in the upstream Spring Framework 5.2.17.RELEASE (released Sept 2021) before TuxCare onboarded it. All three files modified by the security patch contain the acceptProxyClasses protection mechanism: ConfigurableObjectInputStream rejects proxy class deserialization when the flag is false (line ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is NOT present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The fix was already included in the upstream Spring Framework 5.2.17.RELEASE (released Sept 2021) before TuxCare onboarded it. All three files modified by the security patch contain the acceptProxyClasses protection mechanism: ConfigurableObjectInputStream rejects proxy class deserialization when the flag is false (line ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578: The target Spring Framework 5.2.17.RELEASE-tuxcare.3 is NOT affected by the directory traversal vulnerability. The upstream fix commit 8ee4651038 (\"Improve StringUtils.cleanPath\") is present on HEAD and was already included in the upstream release 5.2.17.RELEASE before TuxCare onboarding. The vulnerable code pattern (unconditional path stripping after colon detection) is not pres...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578: The target Spring Framework 5.2.17.RELEASE-tuxcare.3 is NOT affected by the directory traversal vulnerability. The upstream fix commit 8ee4651038 (\"Improve StringUtils.cleanPath\") is present on HEAD and was already included in the upstream release 5.2.17.RELEASE before TuxCare onboarding. The vulnerable code pattern (unconditional path stripping after colon detection) is not pres..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 describes predictable session ID generation in the Spring Framework SockJS client (versions 4.1.x before 4.1.5). The vulnerability was caused by using AlternativeJdkIdGenerator which seeded with SecureRandom once but then used deterministic java.util.Random for all subsequent UUID generation, making session IDs predictable and allowing attackers to send messages to other sessions....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 describes predictable session ID generation in the Spring Framework SockJS client (versions 4.1.x before 4.1.5). The vulnerability was caused by using AlternativeJdkIdGenerator which seeded with SecureRandom once but then used deterministic java.util.Random for all subsequent UUID generation, making session IDs predictable and allowing attackers to send messages to other sessions...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. Spring Framework 5.2.17.RELEASE is not affected by CVE-2015-5211 (Reflected File Download attack). The vulnerability affected versions 4.2.0-4.2.1, 4.0.0-4.1.7, 3.2.0-3.2.14 and older. Version 5.2.17.RELEASE is significantly newer and includes the upstream vendor's fix (commit 2bd1daa75e by rstoyanchev@pivotal.io) that was shipped in v5.2.0.M1. The RFD protection is present in AbstractMessageConverterMethodProcessor.java, which adds Content-Disposition headers for unsafe file extensions. Additionally, JSONP support (another RFD vector) was completely removed in Spring 5.1.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.2.17.RELEASE is not affected by CVE-2015-5211 (Reflected File Download attack). The vulnerability affected versions 4.2.0-4.2.1, 4.0.0-4.1.7, 3.2.0-3.2.14 and older. Version 5.2.17.RELEASE is significantly newer and includes the upstream vendor's fix (commit 2bd1daa75e by rstoyanchev@pivotal.io) that was shipped in v5.2.0.M1. The RFD protection is present in AbstractMessageConverterMethodProcessor.java, which adds Content-Disposition headers for unsafe file extensions. Additionally, JSONP support (another RFD vector) was completely removed in Spring 5.1.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. Target Spring Framework 5.2.17.RELEASE is NOT AFFECTED by CVE-2016-5007. The vulnerability (pattern matching discrepancies between Spring Security and Spring MVC leading to authorization bypass) was fixed in upstream Spring Framework v4.3.1.RELEASE (April 2016) via commit a30ab30e4e, which introduced the MatchableHandlerMapping API. This fix was already present in the upstream 5.2.17.RELEASE that TuxCare onboarded, confirmed by git ancestry analysis showing the fix commit predates the first TuxCare onboarding commit by 8969 commits. All defense components (MatchableHandlerMapping interface, HandlerMappingIntrospector helper, RequestMatchResult class) are present and implemented in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Target Spring Framework 5.2.17.RELEASE is NOT AFFECTED by CVE-2016-5007. The vulnerability (pattern matching discrepancies between Spring Security and Spring MVC leading to authorization bypass) was fixed in upstream Spring Framework v4.3.1.RELEASE (April 2016) via commit a30ab30e4e, which introduced the MatchableHandlerMapping API. This fix was already present in the upstream 5.2.17.RELEASE that TuxCare onboarded, confirmed by git ancestry analysis showing the fix commit predates the first TuxCare onboarding commit by 8969 commits. All defense components (MatchableHandlerMapping interface, HandlerMappingIntrospector helper, RequestMatchResult class) are present and implemented in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2018-11040 is not present in Spring Framework 5.2.17.RELEASE-tuxcare.3. JSONP support was completely removed by upstream commit ac37b678a3 (June 2018) authored by Sebastien Deleuze, which was already part of the upstream 5.2.17.RELEASE when TuxCare onboarded it. The vulnerable code (MappingJackson2JsonView with default-enabled jsonpParameterNames, AbstractJsonpResponseBodyAdvice, and JSONP transport handlers) does not exist in the target. No JSONP-related fields, methods, or classes remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 is not present in Spring Framework 5.2.17.RELEASE-tuxcare.3. JSONP support was completely removed by upstream commit ac37b678a3 (June 2018) authored by Sebastien Deleuze, which was already part of the upstream 5.2.17.RELEASE when TuxCare onboarded it. The vulnerable code (MappingJackson2JsonView with default-enabled jsonpParameterNames, AbstractJsonpResponseBodyAdvice, and JSONP transport handlers) does not exist in the target. No JSONP-related fields, methods, or classes remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework versions before 4.3.14 and 5.0.3, where URL path parameters with special encodings could bypass security constraints. The target version 5.2.17.RELEASE (released Sept 2021) is 3+ years newer than the fixed versions. The defense mechanism (UrlPathHelper.removeSemicolonContent = true by default) has been present since 2012 (commit 2201dd8c) and is confirmed ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework versions before 4.3.14 and 5.0.3, where URL path parameters with special encodings could bypass security constraints. The target version 5.2.17.RELEASE (released Sept 2021) is 3+ years newer than the fixed versions. The defense mechanism (UrlPathHelper.removeSemicolonContent = true by default) has been present since 2012 (commit 2201dd8c) and is confirmed ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 (ReDoS via STOMP selector header) is not present in Spring Framework 5.2.17.RELEASE. The fix (allowing selector header to be disabled via null configuration) was already included in upstream version 5.2.17.RELEASE before TuxCare onboarded it. The vulnerable pattern - unguarded parsing of attacker-supplied Spring EL expressions in subscription selector headers - does not exist in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 (ReDoS via STOMP selector header) is not present in Spring Framework 5.2.17.RELEASE. The fix (allowing selector header to be disabled via null configuration) was already included in upstream version 5.2.17.RELEASE before TuxCare onboarded it. The vulnerable pattern - unguarded parsing of attacker-supplied Spring EL expressions in subscription selector headers - does not exist in t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2018-1258 is not present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The vulnerability (authorization bypass via incorrect method resolution for dynamic proxy classes in Spring Security method-level annotations) was fixed in upstream Spring Framework before v5.2.17.RELEASE was released (2021-09-15). Both required patches are present: (1) consistent target method resolution in cache/event expressions (commit eaff2c28a7, 2018-04-27) and (2) corrected AopUtils.getMostSpecificMethod behavior for proxy classes (commit aa11721ff0, 2018-04-27). The target code shows all fix artifacts: AopUtils.getMostSpecificMethod removes proxy exclusion check, AnnotationMethodMatcher adds proxy early-return guard, CacheAspectSupport and ApplicationListenerMethodAdapter pre-resolve targetMethod with proxy-aware logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is not present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The vulnerability (authorization bypass via incorrect method resolution for dynamic proxy classes in Spring Security method-level annotations) was fixed in upstream Spring Framework before v5.2.17.RELEASE was released (2021-09-15). Both required patches are present: (1) consistent target method resolution in cache/event expressions (commit eaff2c28a7, 2018-04-27) and (2) corrected AopUtils.getMostSpecificMethod behavior for proxy classes (commit aa11721ff0, 2018-04-27). The target code shows all fix artifacts: AopUtils.getMostSpecificMethod removes proxy exclusion check, AnnotationMethodMatcher adds proxy early-return guard, CacheAspectSupport and ApplicationListenerMethodAdapter pre-resolve targetMethod with proxy-aware logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.17.RELEASE is not affected by CVE-2018-1271 (directory traversal via URL-encoded paths). The vulnerability was fixed in upstream Spring Framework 5.2.0.M1 (March 2018) via commits implementing isInvalidEncodedPath() validation and backslash normalization. The fix was already present in the upstream 5.2.17.RELEASE that TuxCare onboarded. All affected files (ResourceHttpReque...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.17.RELEASE is not affected by CVE-2018-1271 (directory traversal via URL-encoded paths). The vulnerability was fixed in upstream Spring Framework 5.2.0.M1 (March 2018) via commits implementing isInvalidEncodedPath() validation and backslash normalization. The fix was already present in the upstream 5.2.17.RELEASE that TuxCare onboarded. All affected files (ResourceHttpReque..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. The target Spring Framework 5.2.17.RELEASE is NOT affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using java.util.Random, which could allow attackers to predict boundaries and inject additional multipart parts into proxied requests. The fix (replacing Random with SecureRandom) was introduced by upstream developer Rossen Stoyanchev in commit ab2410c754b67902f002bfcc0c3895bd7772d39f and was already present in the upstream 5.2.17.RELEASE when TuxCare onboarded it. The target code uses SecureRandom throughout all multipart boundary generation paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "The target Spring Framework 5.2.17.RELEASE is NOT affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using java.util.Random, which could allow attackers to predict boundaries and inject additional multipart parts into proxied requests. The fix (replacing Random with SecureRandom) was introduced by upstream developer Rossen Stoyanchev in commit ab2410c754b67902f002bfcc0c3895bd7772d39f and was already present in the upstream 5.2.17.RELEASE when TuxCare onboarded it. The target code uses SecureRandom throughout all multipart boundary generation paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core. CVE-2018-15756 range header DoS vulnerability is NOT present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The upstream vendor fix (commit 423aa28ed) was already included in the upstream 5.2.17.RELEASE before TuxCare onboarded it. Both required defenses are present: MAX_RANGES=100 limit (line 136-138) prevents excessive range count attacks, and overlapping range validation (lines 185-195) prevents sum-of-ranges DoS attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 range header DoS vulnerability is NOT present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The upstream vendor fix (commit 423aa28ed) was already included in the upstream 5.2.17.RELEASE before TuxCare onboarded it. Both required defenses are present: MAX_RANGES=100 limit (line 136-138) prevents excessive range count attacks, and overlapping range validation (lines 185-195) prevents sum-of-ranges DoS attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:33:00.043927+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:32:39.051339+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.17.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:33:00.043927+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.2.17.RELEASE-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}