{
  "@id": "urn:uuid:c7ba5599-c1a5-4333-ada9-14b8e073de48",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:40:04.386984+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:56:36.515763+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.2.7.RELEASE is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6 (released 2006). Spring 5.2.7.RELEASE requires JDK 8+ (released 2014) and cannot run on the vulnerable JDK versions. The target uses Java 8 language features (lambdas, streams) that are syntactically incompatibl...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.2.7.RELEASE is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6 (released 2006). Spring 5.2.7.RELEASE requires JDK 8+ (released 2014) and cannot run on the vulnerable JDK versions. The target uses Java 8 language features (lambdas, streams) that are syntactically incompatibl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:04.386984+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.7.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.2.7.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:52:00.073904+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target repository contains the complete upstream fix for CVE-2011-2894. The acceptProxyClasses defense mechanism was introduced by Spring Framework maintainer Juergen Hoeller (jhoeller@vmware.com) on July 21, 2011, in commit 7d8aa05c40. This fix predates TuxCare's onboarding of version 5.2.7.RELEASE and is an upstream vendor fix, not a TuxCare backport. All three patched files (ConfigurableObje...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Target repository contains the complete upstream fix for CVE-2011-2894. The acceptProxyClasses defense mechanism was introduced by Spring Framework maintainer Juergen Hoeller (jhoeller@vmware.com) on July 21, 2011, in commit 7d8aa05c40. This fix predates TuxCare's onboarding of version 5.2.7.RELEASE and is an upstream vendor fix, not a TuxCare backport. All three patched files (ConfigurableObje..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target version 5.2.7.RELEASE (released June 2020) is not affected because the vulnerability was fixed in the upstream Spring Framework in May 2014, six years before this version was released. The fix validates that colon-prefixed path segments are legitimate URI schemes before tre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is a directory traversal vulnerability in Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The target version 5.2.7.RELEASE (released June 2020) is not affected because the vulnerability was fixed in the upstream Spring Framework in May 2014, six years before this version was released. The fix validates that colon-prefixed path segments are legitimate URI schemes before tre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:20:00.402348+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target version 5.2.7.RELEASE is not affected because the fix (switching from AlternativeJdkIdGenerator to JdkIdGenerator) was already present in the upstream release when TuxCare onboarded it. The vulnerable pattern (using AlternativeJdkIdGenerator with predictable R...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target version 5.2.7.RELEASE is not affected because the fix (switching from AlternativeJdkIdGenerator to JdkIdGenerator) was already present in the upstream release when TuxCare onboarded it. The vulnerable pattern (using AlternativeJdkIdGenerator with predictable R..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:09:44.726673+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.2.7.RELEASE. The vulnerability was fixed by upstream Spring team in October 2015 (commit 2bd1daa75e) and this fix was already included in the 5.2.7.RELEASE before TuxCare onboarded it. The fix includes: (1) Content-Disposition header protection with safe filename for unknown extensions, (2) SAFE_EXTENSIONS whitelist (txt, text, yml, properties, csv, json, xml, atom, rss, png, jpe, jpeg, jpg, gif, wbmp, bmp), (3) Path parameter handling to prevent extension hiding via semicolons. The defense code is present and functional at spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractMessageConverterMethodProcessor.java lines 78-496.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.2.7.RELEASE. The vulnerability was fixed by upstream Spring team in October 2015 (commit 2bd1daa75e) and this fix was already included in the 5.2.7.RELEASE before TuxCare onboarded it. The fix includes: (1) Content-Disposition header protection with safe filename for unknown extensions, (2) SAFE_EXTENSIONS whitelist (txt, text, yml, properties, csv, json, xml, atom, rss, png, jpe, jpeg, jpg, gif, wbmp, bmp), (3) Path parameter handling to prevent extension hiding via semicolons. The defense code is present and functional at spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractMessageConverterMethodProcessor.java lines 78-496.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:59.012677+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.2.7.RELEASE. The vulnerability concerned inconsistent URL pattern matching between Spring Security and Spring MVC, which could allow authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev, introduced in Spring Framework 4.3.1 in June 2016) added the MatchableHandlerMapping interface and supporting infrastructure to expose Spring MVC's internal pattern matching logic, allowing Spring Security to use identical matching rules. This fix was already present in the upstream 5.2.7.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.2.7.RELEASE. The vulnerability concerned inconsistent URL pattern matching between Spring Security and Spring MVC, which could allow authorization bypass. The upstream fix (commit a30ab30e4e by Rossen Stoyanchev, introduced in Spring Framework 4.3.1 in June 2016) added the MatchableHandlerMapping interface and supporting infrastructure to expose Spring MVC's internal pattern matching logic, allowing Spring Security to use identical matching rules. This fix was already present in the upstream 5.2.7.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:00:42.857553+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-11040 (JSONP cross-origin data disclosure) is NOT present in Spring Framework 5.2.7.RELEASE. The vulnerable JSONP support code was completely removed by upstream Spring Framework in version 5.1.0 (commit ac37b678a3, SPR-16914), which predates the target version. All JSONP-related classes (AbstractJsonpResponseBodyAdvice, JsonpPollingTransportHandler, JsonpReceivingTransportHandler) and methods (MappingJackson2JsonView's jsonpParameterNames field and related handlers, MappingJacksonValue's JSONP methods) have been removed. The removal was authored by Sebastien Deleuze (sdeleuze@pivotal.io) and shipped in the upstream 5.2.7.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 (JSONP cross-origin data disclosure) is NOT present in Spring Framework 5.2.7.RELEASE. The vulnerable JSONP support code was completely removed by upstream Spring Framework in version 5.1.0 (commit ac37b678a3, SPR-16914), which predates the target version. All JSONP-related classes (AbstractJsonpResponseBodyAdvice, JsonpPollingTransportHandler, JsonpReceivingTransportHandler) and methods (MappingJackson2JsonView's jsonpParameterNames field and related handlers, MappingJacksonValue's JSONP methods) have been removed. The removal was authored by Sebastien Deleuze (sdeleuze@pivotal.io) and shipped in the upstream 5.2.7.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:15:16.880365+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.2.7.RELEASE-tuxcare.3 is not affected by CVE-2018-1199. All defensive mechanisms for this vulnerability were already present in the upstream 5.2.7.RELEASE before TuxCare onboarded it. The code includes: (1) semicolon content removal enabled by default in UrlPathHelper since version 3.2 (2012), (2) duplicate slash normalization via cleanDuplicateSlashes(), (3) backs...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.2.7.RELEASE-tuxcare.3 is not affected by CVE-2018-1199. All defensive mechanisms for this vulnerability were already present in the upstream 5.2.7.RELEASE before TuxCare onboarded it. The code includes: (1) semicolon content removal enabled by default in UrlPathHelper since version 3.2 (2012), (2) duplicate slash normalization via cleanDuplicateSlashes(), (3) backs..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target version 5.2.7.RELEASE is much later and already contains the upstream fix that allows disabling the selector header feature to prevent ReDoS attacks. The fix (null-check guard before selector expression parsing and ability to set selectorHeaderName to null) was present in the upstream 5.2....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target version 5.2.7.RELEASE is much later and already contains the upstream fix that allows disabling the selector header feature to prevent ReDoS attacks. The fix (null-check guard before selector expression parsing and ability to set selectorHeaderName to null) was present in the upstream 5.2...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. Target Spring Framework 5.2.7.RELEASE is NOT affected by CVE-2018-1258. The authorization bypass vulnerability affecting Spring Framework 5.0.5 was fixed in upstream releases before 5.2.7.RELEASE. The fix commits (eaff2c28a7 for cache/event expression evaluation and aa11721 for AopUtils proxy handling) were authored by the upstream Spring team and shipped in the 5.2.7.RELEASE that TuxCare onboarded. The vulnerable code pattern (incorrect method resolution on proxy objects leading to security annotation bypass) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Target Spring Framework 5.2.7.RELEASE is NOT affected by CVE-2018-1258. The authorization bypass vulnerability affecting Spring Framework 5.0.5 was fixed in upstream releases before 5.2.7.RELEASE. The fix commits (eaff2c28a7 for cache/event expression evaluation and aa11721 for AopUtils proxy handling) were authored by the upstream Spring team and shipped in the 5.2.7.RELEASE that TuxCare onboarded. The vulnerable code pattern (incorrect method resolution on proxy objects leading to security annotation bypass) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:03:00.088654+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15 (directory traversal when serving static resources on Windows via URL-encoded path sequences). The target version 5.2.7.RELEASE (March 2020) is NOT vulnerable. The fix for CVE-2018-1271 was applied by upstream Spring maintainers in March 2018 (commit f59ea610df) and shipped in versions 5.0.5 and 4.3.15. Version 5....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15 (directory traversal when serving static resources on Windows via URL-encoded path sequences). The target version 5.2.7.RELEASE (March 2020) is NOT vulnerable. The fix for CVE-2018-1271 was applied by upstream Spring maintainers in March 2018 (commit f59ea610df) and shipped in versions 5.0.5 and 4.3.15. Version 5...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 fix (SecureRandom for multipart boundary generation) was already present in upstream Spring Framework 5.2.7.RELEASE when TuxCare onboarded it. The vulnerable pattern (predictable new Random()) is not present in the target. Commit ab2410c754 by rstoyanchev@pivotal.io introduced SecureRandom and is an ancestor of the upstream 5.2.7.RELEASE tag (6110925ecc), which predates the first TuxCare commit (48a16dc383 onboarding). The fix makes multipart boundaries cryptographically unpredictable, preventing the boundary collision attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 fix (SecureRandom for multipart boundary generation) was already present in upstream Spring Framework 5.2.7.RELEASE when TuxCare onboarded it. The vulnerable pattern (predictable new Random()) is not present in the target. Commit ab2410c754 by rstoyanchev@pivotal.io introduced SecureRandom and is an ancestor of the upstream 5.2.7.RELEASE tag (6110925ecc), which predates the first TuxCare commit (48a16dc383 onboarding). The fix makes multipart boundaries cryptographically unpredictable, preventing the boundary collision attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:44:47.079180+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 (HTTP Range DoS) is NOT present in Spring Framework 5.2.7.RELEASE. The upstream fix by Rossen Stoyanchev (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e, dated Oct 3, 2018) was already included in the 5.2.7.RELEASE version when TuxCare onboarded it. The fix adds two defenses: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges, and (2) validation that the sum of multiple range sizes does not meet/exceed resource length. Both defenses are present and active in HttpRange.java at lines 48, 136-138, and 185-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 (HTTP Range DoS) is NOT present in Spring Framework 5.2.7.RELEASE. The upstream fix by Rossen Stoyanchev (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e, dated Oct 3, 2018) was already included in the 5.2.7.RELEASE version when TuxCare onboarded it. The fix adds two defenses: (1) MAX_RANGES=100 limit rejecting requests with >100 ranges, and (2) validation that the sum of multiple range sizes does not meet/exceed resource length. Both defenses are present and active in HttpRange.java at lines 48, 136-138, and 185-195.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:39:22.988337+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:47:55.059673+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.7.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.7.RELEASE-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T11:39:53.580730+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.7.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.2.7.RELEASE-tuxcare.3."
    }
  ]
}