{
  "@id": "urn:uuid:68472579-2140-4ac5-9afa-59405e31c6ab",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T07:19:10.606688+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.15 is not affected by CVE-2009-1190. The vulnerability required deserializing malicious JdkRegexpMethodPointcut objects with catastrophic regex patterns to exploit JDK <1.6's regex engine flaws. In Spring 5.3.15, the deserialization path is broken: Pattern[] fields are not marked transient, and since java.util.regex.Pattern is not Serializable, any serialization attempt ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.15 is not affected by CVE-2009-1190. The vulnerability required deserializing malicious JdkRegexpMethodPointcut objects with catastrophic regex patterns to exploit JDK <1.6's regex engine flaws. In Spring 5.3.15, the deserialization path is broken: Pattern[] fields are not marked transient, and since java.util.regex.Pattern is not Serializable, any serialization attempt ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 fix was added to Spring Framework in July 2011 (commit 7d8aa05c40) by upstream developer J\u00fcrgen Hoeller, well before Spring Framework 5.3.15 was released. The fix adds an acceptProxyClasses configuration flag to ConfigurableObjectInputStream and RemoteInvocationSerializingExporter that, when set to false, rejects deserialization of proxy classes by throwing NotSerializableExceptio...",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 fix was added to Spring Framework in July 2011 (commit 7d8aa05c40) by upstream developer J\u00fcrgen Hoeller, well before Spring Framework 5.3.15 was released. The fix adds an acceptProxyClasses configuration flag to ConfigurableObjectInputStream and RemoteInvocationSerializingExporter that, when set to false, rejects deserialization of proxy classes by throwing NotSerializableExceptio..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.15 is not affected by CVE-2014-3578. The directory traversal vulnerability was fixed by upstream in commit 8ee465103850a3 (May 2014) which added a check to reject path prefixes containing \"/\" characters. This fix was already present in the upstream Spring Framework 5.3.15 release that TuxCare onboarded, as verified by the fix commit being an ancestor of the first...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.15 is not affected by CVE-2014-3578. The directory traversal vulnerability was fixed by upstream in commit 8ee465103850a3 (May 2014) which added a check to reject path prefixes containing \"/\" characters. This fix was already present in the upstream Spring Framework 5.3.15 release that TuxCare onboarded, as verified by the fix commit being an ancestor of the first..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses java.util.Random after initial seed). The target version 5.3.15 is not affected because the fix was already present in the upstream release: SockJsUrlInfo.java uses JdkIdGenerator (which calls UUID.randomUUID(), cryptographically s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses java.util.Random after initial seed). The target version 5.3.15 is not affected because the fix was already present in the upstream release: SockJsUrlInfo.java uses JdkIdGenerator (which calls UUID.randomUUID(), cryptographically s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.3.15. The vulnerability was fixed by the upstream Spring team in version 4.2.2 (October 2015) via commit 2bd1daa75e, long before version 5.3.15 was released (November 2021). The RFD protection mechanism (Content-Disposition header for non-whitelisted file extensions) is fully present in the target's AbstractMessageConverterMethodProcessor.java. This is an upstream fix that TuxCare inherited when onboarding Spring Framework 5.3.15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 5.3.15. The vulnerability was fixed by the upstream Spring team in version 4.2.2 (October 2015) via commit 2bd1daa75e, long before version 5.3.15 was released (November 2021). The RFD protection mechanism (Content-Disposition header for non-whitelisted file extensions) is fully present in the target's AbstractMessageConverterMethodProcessor.java. This is an upstream fix that TuxCare inherited when onboarding Spring Framework 5.3.15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. Spring Framework 5.3.15 is not affected by CVE-2016-5007. The vulnerability, which involved URL pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypasses, was fixed in Spring Framework 4.3.1 (April 2016) via the introduction of the HandlerMappingIntrospector API. The target version 5.3.15 already contains this upstream fix as part of the base release onboarded by TuxCare. The fix provides an introspection API that allows Spring Security to use Spring MVC's exact pattern matching logic, eliminating the security vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.3.15 is not affected by CVE-2016-5007. The vulnerability, which involved URL pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypasses, was fixed in Spring Framework 4.3.1 (April 2016) via the introduction of the HandlerMappingIntrospector API. The target version 5.3.15 already contains this upstream fix as part of the base release onboarded by TuxCare. The fix provides an introspection API that allows Spring Security to use Spring MVC's exact pattern matching logic, eliminating the security vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. Spring Framework 5.3.15 is not affected by CVE-2018-11040. JSONP support was completely removed from Spring Framework in version 5.1.0.RC1 (June 2018) via upstream commit ac37b678a3. The vulnerable code path that processes HTTP query parameters (\"jsonp\", \"callback\") to wrap JSON responses in JSONP format does not exist in the target. The CVE affects versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, but version 5.3.15 (released 2021) is from a later major version line where JSONP was already removed. The fix was an upstream Spring change shipped in the release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.15 is not affected by CVE-2018-11040. JSONP support was completely removed from Spring Framework in version 5.1.0.RC1 (June 2018) via upstream commit ac37b678a3. The vulnerable code path that processes HTTP query parameters (\"jsonp\", \"callback\") to wrap JSON responses in JSONP format does not exist in the target. The CVE affects versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, but version 5.3.15 (released 2021) is from a later major version line where JSONP was already removed. The fix was an upstream Spring change shipped in the release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.15 is not affected by CVE-2018-1199. The vulnerability, which allowed bypassing security constraints via specially encoded URL path parameters (e.g., %2F for /, backslashes, duplicate slashes), was fixed in upstream Spring Framework commit 0e28bee0f1 (March 2018) as part of SPR-16616. This fix shipped in Spring 5.0.3+ and all subsequent releases, including 5.3.0 (October 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.15 is not affected by CVE-2018-1199. The vulnerability, which allowed bypassing security constraints via specially encoded URL path parameters (e.g., %2F for /, backslashes, duplicate slashes), was fixed in upstream Spring Framework commit 0e28bee0f1 (March 2018) as part of SPR-16616. This fix shipped in Spring 5.0.3+ and all subsequent releases, including 5.3.0 (October 20..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 The target repository (Spring Framework 5.3.15) is NOT affected by CVE-2018-1257. The vulnerability was a regular expression denial of service attack through malicious Spring EL expressions in STOMP message selector headers. The fix, which allows the selector header feature to be disabled or reconfigured, was already present in the upstream Spring Framework 5.3.15 release that TuxCare onboarded...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Framework 5.3.15) is NOT affected by CVE-2018-1257. The vulnerability was a regular expression denial of service attack through malicious Spring EL expressions in STOMP message selector headers. The fix, which allows the selector header feature to be disabled or reconfigured, was already present in the upstream Spring Framework 5.3.15 release that TuxCare onboarded..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. Target version 5.3.15 is NOT affected by CVE-2018-1258. The vulnerability (authorization bypass via incorrect method resolution on JDK dynamic proxies) was fixed in upstream commits aa11721ff0 and eaff2c28a7 (April 2018) authored by Spring developer jhoeller@pivotal.io. Both fixes shipped in the upstream v5.3.15 release (January 2022) before TuxCare maintenance began. All four key files show the FIXED state: AopUtils.getMostSpecificMethod() no longer excludes proxy classes, AnnotationMethodMatcher has the proxy guard, and CacheAspectSupport/ApplicationListenerMethodAdapter consistently resolve target methods. The vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Target version 5.3.15 is NOT affected by CVE-2018-1258. The vulnerability (authorization bypass via incorrect method resolution on JDK dynamic proxies) was fixed in upstream commits aa11721ff0 and eaff2c28a7 (April 2018) authored by Spring developer jhoeller@pivotal.io. Both fixes shipped in the upstream v5.3.15 release (January 2022) before TuxCare maintenance began. All four key files show the FIXED state: AopUtils.getMostSpecificMethod() no longer excludes proxy classes, AnnotationMethodMatcher has the proxy guard, and CacheAspectSupport/ApplicationListenerMethodAdapter consistently resolve target methods. The vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.15 is NOT affected by CVE-2018-1271. The vulnerability, which allowed directory traversal attacks on Windows via encoded backslashes in static resource paths, was fixed in the upstream Spring Framework release before version 5.3.15 was published. The target repository contains the complete upstream fix (commits 91b803a231 and 0e28bee0f1) that validates both forward slash (....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.15 is NOT affected by CVE-2018-1271. The vulnerability, which allowed directory traversal attacks on Windows via encoded backslashes in static resource paths, was fixed in the upstream Spring Framework release before version 5.3.15 was published. The target repository contains the complete upstream fix (commits 91b803a231 and 0e28bee0f1) that validates both forward slash (...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework versions before 5.0.5 and 4.3.15 due to predictable multipart boundary generation using java.util.Random. The target (Spring Framework 5.3.15-tuxcare.2) is NOT affected because the upstream fix (commit 847202c8f8e5 by jhoeller@pivotal.io, June 2018) replaced Random with SecureRandom and was already included in Spring 5.1.0+, well before the 5.3.15 release. The fix uses cryptographically secure random generation to prevent attackers from predicting boundaries and injecting malicious multipart content. TuxCare onboarded version 5.3.15 in October 2026, inheriting the upstream fix. The vulnerable code pattern (predictable Random) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework versions before 5.0.5 and 4.3.15 due to predictable multipart boundary generation using java.util.Random. The target (Spring Framework 5.3.15-tuxcare.2) is NOT affected because the upstream fix (commit 847202c8f8e5 by jhoeller@pivotal.io, June 2018) replaced Random with SecureRandom and was already included in Spring 5.1.0+, well before the 5.3.15 release. The fix uses cryptographically secure random generation to prevent attackers from predicting boundaries and injecting malicious multipart content. TuxCare onboarded version 5.3.15 in October 2026, inheriting the upstream fix. The vulnerable code pattern (predictable Random) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. CVE-2018-15756 is NOT present in Spring Framework 5.3.15. The vulnerability (HTTP Range header DoS via excessive or overlapping range requests) was fixed in upstream Spring Framework 5.1.1.RELEASE (October 2018) via commit 423aa28ed58. The fix includes: (1) limiting Range header to max 100 ranges, and (2) validating that sum of all range lengths is less than resource length. Both defenses are present in the target at spring-web/src/main/java/org/springframework/http/HttpRange.java. Since the target version 5.3.15 was released well after 5.1.1, the fix was already included in the upstream release that TuxCare onboarded. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is NOT present in Spring Framework 5.3.15. The vulnerability (HTTP Range header DoS via excessive or overlapping range requests) was fixed in upstream Spring Framework 5.1.1.RELEASE (October 2018) via commit 423aa28ed58. The fix includes: (1) limiting Range header to max 100 ranges, and (2) validating that sum of all range lengths is less than resource length. Both defenses are present in the target at spring-web/src/main/java/org/springframework/http/HttpRange.java. Since the target version 5.3.15 was released well after 5.1.1, the fix was already included in the upstream release that TuxCare onboarded. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection via unescaped newlines and control characters) is NOT present in Spring Framework 5.3.15. The upstream vendor fix was included in the 5.3.15 release. All key locations that log user-controlled input (PathResourceResolver, ResourceWebHandler, ResourceHttpRequestHandler, websocket handlers) use LogFormatUtils.formatValue() which sanitizes newlines and control charact...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection via unescaped newlines and control characters) is NOT present in Spring Framework 5.3.15. The upstream vendor fix was included in the 5.3.15 release. All key locations that log user-controlled input (PathResourceResolver, ResourceWebHandler, ResourceHttpRequestHandler, websocket handlers) use LogFormatUtils.formatValue() which sanitizes newlines and control charact..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) does NOT affect Spring Framework 5.3.15. The vulnerability was fixed by upstream Spring in version 5.3.14 (commit 99c7608f, Dec 2021) before the 5.3.15 release. The fix added control character sanitization to LogFormatUtils and applied it throughout the codebase where user-controlled input is logged. The CVE explicitly lists only ver...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) does NOT affect Spring Framework 5.3.15. The vulnerability was fixed by upstream Spring in version 5.3.14 (commit 99c7608f, Dec 2021) before the 5.3.15 release. The fix added control character sanitization to LogFormatUtils and applied it throughout the codebase where user-controlled input is logged. The CVE explicitly lists only ver..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI regular-expression matcher is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:188, request matching calls handlerMapping.getHandler(request) and applies the callback directly, without entering a cached-URI matcher.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached-URI regular-expression matcher is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:188, request matching calls handlerMapping.getHandler(request) and applies the callback directly, without entering a cached-URI matcher."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.15-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.15-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T07:19:10.606688+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.15-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}