{
  "@id": "urn:uuid:f6df6695-cb0c-4847-8ddd-f4dbde4c7ca4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:23:00.432361+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:28:00.129946+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6. Spring Framework 5.3.13 requires Java 8+ as its minimum runtime (sourceCompatibility = JavaVersion.VERSION_1_8). Java 8+ includes the regex engine fixes introduced in JDK 1.6 that resolved this CVE's specific algorithmic complexity issues. While Spring processes regex p...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6. Spring Framework 5.3.13 requires Java 8+ as its minimum runtime (sourceCompatibility = JavaVersion.VERSION_1_8). Java 8+ includes the regex engine fixes introduced in JDK 1.6 that resolved this CVE's specific algorithmic complexity issues. While Spring processes regex p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:34:13.730439+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:43:00.134280+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.13-tuxcare.5 is NOT AFFECTED by CVE-2011-2894. The upstream vendor (Spring/VMware) fixed this deserialization vulnerability on July 21, 2011 in commit 7d8aa05c40, which added the acceptProxyClasses flag to ConfigurableObjectInputStream.resolveProxyClass(). This fix was already present in the upstream Spring Framework 5.3.13 release that TuxCare onboarded, appeari...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.13-tuxcare.5 is NOT AFFECTED by CVE-2011-2894. The upstream vendor (Spring/VMware) fixed this deserialization vulnerability on July 21, 2011 in commit 7d8aa05c40, which added the acceptProxyClasses flag to ConfigurableObjectInputStream.resolveProxyClass(). This fix was already present in the upstream Spring Framework 5.3.13 release that TuxCare onboarded, appeari..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.13-tuxcare.5. The vulnerability was a directory traversal flaw in StringUtils.cleanPath() that allowed attackers to bypass path normalization using crafted paths like `/a/:b/../../file` (colon after slashes tricks the prefix extraction). The fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was authored by upstream Spring Framework develo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.13-tuxcare.5. The vulnerability was a directory traversal flaw in StringUtils.cleanPath() that allowed attackers to bypass path normalization using crafted paths like `/a/:b/../../file` (colon after slashes tricks the prefix extraction). The fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was authored by upstream Spring Framework develo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:12:30.660956+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which relies on java.util.Random). The target version (5.3.13) uses JdkIdGenerator with UUID.randomUUID(), providing cryptographically secure random session IDs. The fix was introduced in upstream version 4.1.5 (commit 52b8f344 by Rossen Stoy...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which relies on java.util.Random). The target version (5.3.13) uses JdkIdGenerator with UUID.randomUUID(), providing cryptographically secure random session IDs. The fix was introduced in upstream version 4.1.5 (commit 52b8f344 by Rossen Stoy..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:01:12.948527+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.13 is not affected by CVE-2015-5211 (Reflected File Download attack). The upstream fix was committed in October 2015 (commit 2bd1daa75e) by upstream Spring developers and shipped in the base release before TuxCare maintenance began. The RFD defense is present and active: AbstractMessageConverterMethodProcessor adds Content-Disposition headers with safe filenames for non-whitelisted extensions. Additionally, JSONP support (another RFD vector) was completely removed in Spring 5.0 (2018), eliminating that attack surface entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.3.13 is not affected by CVE-2015-5211 (Reflected File Download attack). The upstream fix was committed in October 2015 (commit 2bd1daa75e) by upstream Spring developers and shipped in the base release before TuxCare maintenance began. The RFD defense is present and active: AbstractMessageConverterMethodProcessor adds Content-Disposition headers with safe filenames for non-whitelisted extensions. Additionally, JSONP support (another RFD vector) was completely removed in Spring 5.0 (2018), eliminating that attack surface entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:59.149107+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.3.13. The vulnerability concerned pattern matching discrepancies between Spring Security (authorization) and Spring MVC (routing) that could allow authorization bypass. The upstream fix (commit a30ab30e4e, \"Introduce HandlerMapping introspection API\" by Rossen Stoyanchev, Spring Framework 4.3.1) added HandlerMappingIntrospector and MatchableHandlerMapping interfaces to allow authorization systems to query Spring MVC's exact pattern matching behavior, eliminating discrepancies. This fix is present in the target at HEAD and was shipped in the upstream release that TuxCare onboarded (commit is an ancestor of first TuxCare commit 37ad78d900). All key components verified: HandlerMappingIntrospector, MatchableHandlerMapping interface, RequestMatchResult, and implementing classes (AbstractUrlHandlerMapping line 374, RequestMappingHandlerMapping line 413) are present and functional.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.3.13. The vulnerability concerned pattern matching discrepancies between Spring Security (authorization) and Spring MVC (routing) that could allow authorization bypass. The upstream fix (commit a30ab30e4e, \"Introduce HandlerMapping introspection API\" by Rossen Stoyanchev, Spring Framework 4.3.1) added HandlerMappingIntrospector and MatchableHandlerMapping interfaces to allow authorization systems to query Spring MVC's exact pattern matching behavior, eliminating discrepancies. This fix is present in the target at HEAD and was shipped in the upstream release that TuxCare onboarded (commit is an ancestor of first TuxCare commit 37ad78d900). All key components verified: HandlerMappingIntrospector, MatchableHandlerMapping interface, RequestMatchResult, and implementing classes (AbstractUrlHandlerMapping line 374, RequestMappingHandlerMapping line 413) are present and functional.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:56:02.232476+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.13 is not affected by CVE-2018-11040. The vulnerable JSONP support in MappingJackson2JsonView and AbstractJsonpResponseBodyAdvice was completely removed by the upstream vendor in commit ac37b678a3 (June 7, 2018), well before the 5.3.13 release. The target code contains no JSONP parameter handling, no jsonpParameterNames field, and no automatic cross-origin wrapping functionality. This is an upstream vendor fix that shipped in the 5.3.13 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.13 is not affected by CVE-2018-11040. The vulnerable JSONP support in MappingJackson2JsonView and AbstractJsonpResponseBodyAdvice was completely removed by the upstream vendor in commit ac37b678a3 (June 7, 2018), well before the 5.3.13 release. The target code contains no JSONP parameter handling, no jsonpParameterNames field, and no automatic cross-origin wrapping functionality. This is an upstream vendor fix that shipped in the 5.3.13 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:05:00.128546+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.13 is not affected by CVE-2018-1199. The vulnerability pattern (URL path bypass via special encodings, backslashes, or duplicate slashes in resource paths) is not present because the upstream fix was included in the 5.3.13 release. The target contains comprehensive defensive code: processPath() normalizes paths by converting backslashes to forward slashes and removing dupli...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.13 is not affected by CVE-2018-1199. The vulnerability pattern (URL path bypass via special encodings, backslashes, or duplicate slashes in resource paths) is not present because the upstream fix was included in the 5.3.13 release. The target contains comprehensive defensive code: processPath() normalizes paths by converting backslashes to forward slashes and removing dupli..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework STOMP WebSocket endpoints with selector header ReDoS vulnerability. The target version 5.3.13 is NOT AFFECTED because the upstream fix (commit ff2228fdaf by Rossen Stoyanchev) was already present in the upstream release before TuxCare started maintaining this version. The fix adds the ability to disable the vulnerable selector feature by setting selectorHe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework STOMP WebSocket endpoints with selector header ReDoS vulnerability. The target version 5.3.13 is NOT AFFECTED because the upstream fix (commit ff2228fdaf by Rossen Stoyanchev) was already present in the upstream release before TuxCare started maintaining this version. The fix adds the ability to disable the vulnerable selector feature by setting selectorHe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 (authorization bypass via improper method resolution on JDK dynamic proxies) is not present in Spring Framework 5.3.13. All three critical fixes from upstream commits eaff2c28a7 and aa11721ff0 are present: (1) AopUtils.getMostSpecificMethod no longer excludes proxy classes, (2) CacheAspectSupport and ApplicationListenerMethodAdapter add proxy checks with targetMethod field resolution, and (3) AnnotationMethodMatcher returns false early for proxy classes. These fixes were authored by upstream Spring maintainer jhoeller@pivotal.io and shipped in the upstream 5.3.13 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 (authorization bypass via improper method resolution on JDK dynamic proxies) is not present in Spring Framework 5.3.13. All three critical fixes from upstream commits eaff2c28a7 and aa11721ff0 are present: (1) AopUtils.getMostSpecificMethod no longer excludes proxy classes, (2) CacheAspectSupport and ApplicationListenerMethodAdapter add proxy checks with targetMethod field resolution, and (3) AnnotationMethodMatcher returns false early for proxy classes. These fixes were authored by upstream Spring maintainer jhoeller@pivotal.io and shipped in the upstream 5.3.13 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:44:00.120801+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework version 5.3.13-tuxcare.4 is NOT AFFECTED by CVE-2018-1271 (directory traversal vulnerability via Windows path separators). The upstream vendor fix for SPR-16616 was released in Spring Framework v5.0.5.RELEASE (March 2018) and is present in the target version. The fix includes: (1) backslash-to-forward-slash normalization in path processing, (2) duplicate slash remova...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework version 5.3.13-tuxcare.4 is NOT AFFECTED by CVE-2018-1271 (directory traversal vulnerability via Windows path separators). The upstream vendor fix for SPR-16616 was released in Spring Framework v5.0.5.RELEASE (March 2018) and is present in the target version. The fix includes: (1) backslash-to-forward-slash normalization in path processing, (2) duplicate slash remova..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The vulnerability involves predictable multipart boundary generation using java.util.Random, allowing attackers to inject extra multipart parts and cause privilege escalation. The target version 5.3.13 is NOT vulnerable because the fix was already present in the upstream 5.0.5 release (March 2018), which replaced Random with SecureRandom for boundary generation. The current code uses lazy initialization of SecureRandom (line 377 in MimeTypeUtils.java), and all multipart boundary generation paths delegate to this secure implementation. The fix was authored by upstream Spring developers (rstoyanchev@pivotal.io) and shipped in v5.0.5.RELEASE, well before TuxCare's involvement with this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The vulnerability involves predictable multipart boundary generation using java.util.Random, allowing attackers to inject extra multipart parts and cause privilege escalation. The target version 5.3.13 is NOT vulnerable because the fix was already present in the upstream 5.0.5 release (March 2018), which replaced Random with SecureRandom for boundary generation. The current code uses lazy initialization of SecureRandom (line 377 in MimeTypeUtils.java), and all multipart boundary generation paths delegate to this secure implementation. The fix was authored by upstream Spring developers (rstoyanchev@pivotal.io) and shipped in v5.0.5.RELEASE, well before TuxCare's involvement with this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:38:06.578576+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.13 is not affected by CVE-2018-15756. The vulnerability (HTTP Range request DoS via excessive or overlapping ranges) was fixed by upstream vendor in commit 423aa28ed5 (Oct 2018) and shipped in Spring Framework 5.3.13 release (Nov 2021). Both required defenses are present: (1) MAX_RANGES=100 limit at HttpRange.java:48,136-138 rejects >100 ranges, and (2) overlapping-range validation at lines 185-195 rejects requests where total range size >= resource length. The fix was authored by upstream (rstoyanchev@pivotal.io) and was already in the upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 5.3.13 is not affected by CVE-2018-15756. The vulnerability (HTTP Range request DoS via excessive or overlapping ranges) was fixed by upstream vendor in commit 423aa28ed5 (Oct 2018) and shipped in Spring Framework 5.3.13 release (Nov 2021). Both required defenses are present: (1) MAX_RANGES=100 limit at HttpRange.java:48,136-138 rejects >100 ranges, and (2) overlapping-range validation at lines 185-195 rejects requests where total range size >= resource length. The fix was authored by upstream (rstoyanchev@pivotal.io) and was already in the upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:38:26.065594+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:28:39.219723+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.13 is not affected by CVE-2021-22096 (log injection vulnerability). The CVE affects versions 5.3.0-5.3.10, and version 5.3.13 includes the upstream vendor fix (commit 05ea991d62) that removed vulnerable resource location logging. The fix was shipped in the upstream 5.3.13 release (Nov 11, 2021) before any TuxCare modifications. Additional sanitization via LogForm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.13 is not affected by CVE-2021-22096 (log injection vulnerability). The CVE affects versions 5.3.0-5.3.10, and version 5.3.13 includes the upstream vendor fix (commit 05ea991d62) that removed vulnerable resource location logging. The fix was shipped in the upstream 5.3.13 release (Nov 11, 2021) before any TuxCare modifications. Additional sanitization via LogForm..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:23:00.432361+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request URI comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:144, the introspection path wraps each request and resolves its handler directly, without CachedResult or the URI comparison that treats attacker-controlled input as a regular expression.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request URI comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:144, the introspection path wraps each request and resolves its handler directly, without CachedResult or the URI comparison that treats attacker-controlled input as a regular expression."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:38:15.132025+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.13-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.13-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.13-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.13-tuxcare.5."
    }
  ]
}