{
  "@id": "urn:uuid:998fa714-739c-4570-a6b3-88c40ae03c73",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:23:42.223331+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:32:00.177155+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes a regex DoS vulnerability in JDK before 1.6 when used with Spring Framework versions 1.1.0-2.5.6 and 3.0.0.M1-M2. Spring Framework 5.3.18 requires Java 8+ (released 2014), which has significantly improved regex engine handling compared to pre-Java-6 implementations. The specific algorithmic complexity vulnerability in Pattern.compile() described in the CVE does not exist...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes a regex DoS vulnerability in JDK before 1.6 when used with Spring Framework versions 1.1.0-2.5.6 and 3.0.0.M1-M2. Spring Framework 5.3.18 requires Java 8+ (released 2014), which has significantly improved regex engine handling compared to pre-Java-6 implementations. The specific algorithmic complexity vulnerability in Pattern.compile() described in the CVE does not exist..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:35:36.236015+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.18 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.18 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:45:17.985105+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.18 is NOT affected by CVE-2011-2894. The vulnerable code pattern from versions 3.0.0-3.0.5 (unrestricted proxy class deserialization with no mitigation mechanism) is not present. The fix was added by upstream Spring maintainer Juergen Hoeller (jhoeller@vmware.com) in commit 7d8aa05c40 on 2011-07-21, introducing an acceptProxyClasses configuration flag that allows rejecting ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.18 is NOT affected by CVE-2011-2894. The vulnerable code pattern from versions 3.0.0-3.0.5 (unrestricted proxy class deserialization with no mitigation mechanism) is not present. The fix was added by upstream Spring maintainer Juergen Hoeller (jhoeller@vmware.com) in commit 7d8aa05c40 on 2011-07-21, introducing an acceptProxyClasses configuration flag that allows rejecting ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.18 is NOT affected by CVE-2014-3578. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already present in the upstream Spring Framework 5.3.18 release before TuxCare onboarded it. The fix prevents directory traversal attacks by validating that URL scheme prefixes do not contain path separators, blocking malicious inputs like '/a/:b/../../sens...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.18 is NOT affected by CVE-2014-3578. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already present in the upstream Spring Framework 5.3.18 release before TuxCare onboarded it. The fix prevents directory traversal attacks by validating that URL scheme prefixes do not contain path separators, blocking malicious inputs like '/a/:b/../../sens..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:12:11.834364+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable SockJS session ID generation. The target version 5.3.18 is NOT affected because the upstream fix from version 4.1.5 (January 2015) is already present in the codebase. The vulnerable pattern (using AlternativeJdkIdGenerator with predictable Random sequences) has been replaced with JdkIdGenerator which uses cryptographic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable SockJS session ID generation. The target version 5.3.18 is NOT affected because the upstream fix from version 4.1.5 (January 2015) is already present in the codebase. The vulnerable pattern (using AlternativeJdkIdGenerator with predictable Random sequences) has been replaced with JdkIdGenerator which uses cryptographic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download vulnerability) was fixed in the upstream Spring Framework in October 2015 via commits 2bd1daa75e, a95c3d820d, and 03f547eb98. Version 5.3.18 was released in April 2022, already containing the fix. The RFD protections are present: Content-Disposition header mechanism with SAFE_EXTENSIONS whitelist in AbstractMessageConverterMethodProcessor, and JSONP support (a major RFD vector) was completely removed in June 2018. The fix was authored by upstream Spring developers (rstoyanchev@pivotal.io) and shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download vulnerability) was fixed in the upstream Spring Framework in October 2015 via commits 2bd1daa75e, a95c3d820d, and 03f547eb98. Version 5.3.18 was released in April 2022, already containing the fix. The RFD protections are present: Content-Disposition header mechanism with SAFE_EXTENSIONS whitelist in AbstractMessageConverterMethodProcessor, and JSONP support (a major RFD vector) was completely removed in June 2018. The fix was authored by upstream Spring developers (rstoyanchev@pivotal.io) and shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:14:44.515379+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.3.18. The vulnerability concerned inconsistent URL pattern matching between Spring Security and Spring MVC, allowing authorization bypass. The fix (HandlerMappingIntrospector API and MatchableHandlerMapping interface) was introduced in upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by Rossen Stoyanchev (rstoyanchev@pivotal.io) and shipped in upstream release v4.3.1.RELEASE (April 2016). The target version 5.3.18 (released ~5 years later) inherits this fix from the upstream release, with the fix commit being an ancestor of the first TuxCare commit (034d153bb57507566fd9bcc9db2b1c51f88242b0) in the 5.3.18 branch history. All required components are present and functional: MatchableHandlerMapping interface with match() method, HandlerMappingIntrospector introspection API, and implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.3.18. The vulnerability concerned inconsistent URL pattern matching between Spring Security and Spring MVC, allowing authorization bypass. The fix (HandlerMappingIntrospector API and MatchableHandlerMapping interface) was introduced in upstream commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by Rossen Stoyanchev (rstoyanchev@pivotal.io) and shipped in upstream release v4.3.1.RELEASE (April 2016). The target version 5.3.18 (released ~5 years later) inherits this fix from the upstream release, with the fix commit being an ancestor of the first TuxCare commit (034d153bb57507566fd9bcc9db2b1c51f88242b0) in the 5.3.18 branch history. All required components are present and functional: MatchableHandlerMapping interface with match() method, HandlerMappingIntrospector introspection API, and implementations in AbstractUrlHandlerMapping and RequestMappingHandlerMapping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:56:41.543674+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. The target repository (Spring Framework 5.3.18) is NOT affected by CVE-2018-11040. The entire JSONP feature was completely removed from the codebase by upstream commit ac37b678a3 (authored by sdeleuze@pivotal.io on June 7, 2018), which shipped in the Spring Framework 5.3.18 release. The vulnerable code pattern - automatic JSONP support via \"jsonp\" and \"callback\" query parameters in MappingJackson2JsonView - no longer exists. Exhaustive searches confirm zero JSONP-related code remains in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target repository (Spring Framework 5.3.18) is NOT affected by CVE-2018-11040. The entire JSONP feature was completely removed from the codebase by upstream commit ac37b678a3 (authored by sdeleuze@pivotal.io on June 7, 2018), which shipped in the Spring Framework 5.3.18 release. The vulnerable code pattern - automatic JSONP support via \"jsonp\" and \"callback\" query parameters in MappingJackson2JsonView - no longer exists. Exhaustive searches confirm zero JSONP-related code remains in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:06:00.110833+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.18 repository is NOT AFFECTED by CVE-2018-1199. The vulnerability (path traversal via URL-encoded separators bypassing security constraints) was fixed by upstream Spring Framework developers in March 2018 (commit 91b803a231, SPR-16616). This fix was included in Spring Framework 5.0.10+ releases and is present in the v5.3.18 release (March 2022) that TuxCare onboa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.18 repository is NOT AFFECTED by CVE-2018-1199. The vulnerability (path traversal via URL-encoded separators bypassing security constraints) was fixed by upstream Spring Framework developers in March 2018 (commit 91b803a231, SPR-16616). This fix was included in Spring Framework 5.0.10+ releases and is present in the v5.3.18 release (March 2022) that TuxCare onboa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is not present in Spring Framework 5.3.18. The vulnerability, which allowed regex DoS attacks via crafted selector header values in STOMP messages, was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix introduced the ability to disable selector header processing by setting selectorHeaderName to null, and added a null-check guard before parsing selector expr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is not present in Spring Framework 5.3.18. The vulnerability, which allowed regex DoS attacks via crafted selector header values in STOMP messages, was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix introduced the ability to disable selector header processing by setting selectorHeaderName to null, and added a null-check guard before parsing selector expr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. CVE-2018-1258 is NOT present in Spring Framework 5.3.18-tuxcare.3. The vulnerability (authorization bypass via improper proxy method resolution) was fixed in upstream commits aa11721ff0 and eaff2c28a7 authored by Juergen Hoeller on April 27, 2018. These fixes were already included in the upstream Spring Framework 5.3.18 release (March 2022) before TuxCare onboarded this version. The target repository contains all required fixes: AopUtils.getMostSpecificMethod no longer has the blocking proxy-class check, and both CacheAspectSupport and ApplicationListenerMethodAdapter properly handle proxy targets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is NOT present in Spring Framework 5.3.18-tuxcare.3. The vulnerability (authorization bypass via improper proxy method resolution) was fixed in upstream commits aa11721ff0 and eaff2c28a7 authored by Juergen Hoeller on April 27, 2018. These fixes were already included in the upstream Spring Framework 5.3.18 release (March 2022) before TuxCare onboarded this version. The target repository contains all required fixes: AopUtils.getMostSpecificMethod no longer has the blocking proxy-class check, and both CacheAspectSupport and ApplicationListenerMethodAdapter properly handle proxy targets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:49:00.097226+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 (Windows directory traversal via backslash path separators) is NOT present in Spring Framework 5.3.18. The vulnerability was fixed by upstream in Spring 5.0.5 (March 2018, commit 0e28bee0f1 by rstoyanchev@pivotal.io) and was already present in the 5.3.18 release (May 2021) that TuxCare onboarded. All four affected files contain the necessary defenses: PathResourceResolver classes ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 (Windows directory traversal via backslash path separators) is NOT present in Spring Framework 5.3.18. The vulnerability was fixed by upstream in Spring 5.0.5 (March 2018, commit 0e28bee0f1 by rstoyanchev@pivotal.io) and was already present in the 5.3.18 release (May 2021) that TuxCare onboarded. All four affected files contain the necessary defenses: PathResourceResolver classes ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. CVE-2018-1272 is not present in Spring Framework 5.3.18. The vulnerability involved predictable multipart boundary generation using java.util.Random, enabling attackers to inject crafted boundaries and override security-critical fields. The fix (replacing Random with SecureRandom) was implemented by upstream Spring in commit ab2410c754 (March 2018) and was already present in the Spring Framework 5.3.18 release before TuxCare began maintaining this version. Current code at MimeTypeUtils.java:377 uses 'new SecureRandom()' with lazy initialization, making boundary strings cryptographically unpredictable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is not present in Spring Framework 5.3.18. The vulnerability involved predictable multipart boundary generation using java.util.Random, enabling attackers to inject crafted boundaries and override security-critical fields. The fix (replacing Random with SecureRandom) was implemented by upstream Spring in commit ab2410c754 (March 2018) and was already present in the Spring Framework 5.3.18 release before TuxCare began maintaining this version. Current code at MimeTypeUtils.java:377 uses 'new SecureRandom()' with lazy initialization, making boundary strings cryptographically unpredictable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:39:52.216680+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. The target Spring Framework 5.3.18-tuxcare.2 is NOT affected by CVE-2018-15756. The vulnerability pattern (unvalidated HTTP Range header processing) is not present because both required defenses are already in the codebase. The fix was authored by the upstream Spring team (Rossen Stoyanchev, rstoyanchev@pivotal.io) in commit 423aa28ed5 dated Oct 3, 2018, and was already part of upstream Spring Framework 5.3.18 when TuxCare onboarded this version. The defenses prevent DoS attacks via: (1) limiting Range headers to 100 ranges maximum (HttpRange.java line 136-138), and (2) validating that the sum of all requested range byte counts is less than the resource content length (HttpRange.java lines 185-195).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 5.3.18-tuxcare.2 is NOT affected by CVE-2018-15756. The vulnerability pattern (unvalidated HTTP Range header processing) is not present because both required defenses are already in the codebase. The fix was authored by the upstream Spring team (Rossen Stoyanchev, rstoyanchev@pivotal.io) in commit 423aa28ed5 dated Oct 3, 2018, and was already part of upstream Spring Framework 5.3.18 when TuxCare onboarded this version. The defenses prevent DoS attacks via: (1) limiting Range headers to 100 ranges maximum (HttpRange.java line 136-138), and (2) validating that the sum of all requested range byte counts is less than the resource content length (HttpRange.java lines 185-195).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:33:47.811527+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.18 is not affected by CVE-2021-22060 (log injection vulnerability). The upstream vendor (Spring/VMware) fixed this vulnerability in version 5.3.14 via commits e9083d7d and 96a7fc693 by Rossen Stoyanchev, which sanitize user-controlled input before logging using LogFormatUtils.formatValue() and downgrade certain log levels from warn to debug. Since the target vers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.18 is not affected by CVE-2021-22060 (log injection vulnerability). The upstream vendor (Spring/VMware) fixed this vulnerability in version 5.3.14 via commits e9083d7d and 96a7fc693 by Rossen Stoyanchev, which sanitize user-controlled input before logging using LogFormatUtils.formatValue() and downgrade certain log levels from warn to debug. Since the target vers..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T21:30:25.734091+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.18. The upstream vendor (VMware/Pivotal) fixed this vulnerability in commits 99c7608ffe and e9083d7d, which were already included in the upstream 5.3.18 release. The fix sanitizes user input before logging by replacing newline characters with <EOL> and control characters with ? placeholders via ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.18. The upstream vendor (VMware/Pivotal) fixed this vulnerability in commits 99c7608ffe and e9083d7d, which were already included in the upstream 5.3.18 release. The fix sanitizes user input before logging by replacing newline characters with <EOL> and control characters with ? placeholders via ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:23:42.223331+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cache comparison that treats a request URI as a regular expression is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:188, handler mappings are resolved directly for each call; the request wrapper at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:278 only buffers attributes.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cache comparison that treats a request URI as a regular expression is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:188, handler mappings are resolved directly for each call; the request wrapper at spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:278 only buffers attributes."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}