{
  "@id": "urn:uuid:3a4a48c3-b9a6-40b5-867d-a3ad75e22ba5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 54,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:39:09.450487+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:51:09.223913+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6, which causes CPU exhaustion when compiling regex patterns with multiple optional groups. While Spring Framework 5.3.20 still contains PatternEditor that compiles regex patterns without validation, the target is not affected because it requires JDK 8 or later (sourceCompatibility = 1.8)...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6, which causes CPU exhaustion when compiling regex patterns with multiple optional groups. While Spring Framework 5.3.20 still contains PatternEditor that compiles regex patterns without validation, the target is not affected because it requires JDK 8 or later (sourceCompatibility = 1.8)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:39:09.450487+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.20 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.20 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:49:00.106689+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5. The target (Spring Framework 5.3.20-tuxcare.3) is not affected because the upstream fix was already present in the shipped version. The vulnerability involved unsafe deserialization of proxy classes allowing arbitrary code execution. The fix added an `acceptProxyClasses` flag to ConfigurableObjectInputStream and related classes, with a check i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Framework 3.0.0-3.0.5. The target (Spring Framework 5.3.20-tuxcare.3) is not affected because the upstream fix was already present in the shipped version. The vulnerability involved unsafe deserialization of proxy classes allowing arbitrary code execution. The fix added an `acceptProxyClasses` flag to ConfigurableObjectInputStream and related classes, with a check i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 5.3.20. The directory traversal vulnerability in StringUtils.cleanPath() was fixed in upstream Spring Framework 5.0.0.M1+ by commit 8ee4651038 (authored by Rossen Stoyanchev from Pivotal). This fix shipped in the upstream release that TuxCare onboarded, well before version 5.3.20. The vulnerable code pattern (unconditional extraction of path pref...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is not present in Spring Framework 5.3.20. The directory traversal vulnerability in StringUtils.cleanPath() was fixed in upstream Spring Framework 5.0.0.M1+ by commit 8ee4651038 (authored by Rossen Stoyanchev from Pivotal). This fix shipped in the upstream release that TuxCare onboarded, well before version 5.3.20. The vulnerable code pattern (unconditional extraction of path pref..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:20:43.319935+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target version 5.3.20 is NOT vulnerable to CVE-2015-0201. The vulnerability affected Spring Framework 4.1.x before 4.1.5 where the Java SockJS client used AlternativeJdkIdGenerator, which generated predictable session IDs (SecureRandom for initial seed only, then predictable Random). The fix was introduced in Spring Framework 4.1.5 (January 2015) by switching to JdkIdGenerator, which uses UUID....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 Target version 5.3.20 is NOT vulnerable to CVE-2015-0201. The vulnerability affected Spring Framework 4.1.x before 4.1.5 where the Java SockJS client used AlternativeJdkIdGenerator, which generated predictable session IDs (SecureRandom for initial seed only, then predictable Random). The fix was introduced in Spring Framework 4.1.5 (January 2015) by switching to JdkIdGenerator, which uses UUID...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:07:28.836714+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download vulnerability) is not present in Spring Framework 5.3.20-tuxcare.3. The upstream fix was committed by Rossen Stoyanchev (rstoyanchev@pivotal.io) in October 2015 (commit 2bd1daa75e) and was already included in the upstream Spring 5.3.20 release (May 2022) before TuxCare onboarding. The complete RFD defense is active in AbstractMessageConverterMethodProcessor: SAFE_EXTENSIONS whitelist, addContentDispositionHeader() method that validates file extensions and adds Content-Disposition headers for unsafe extensions, preventing browser execution of malicious content.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download vulnerability) is not present in Spring Framework 5.3.20-tuxcare.3. The upstream fix was committed by Rossen Stoyanchev (rstoyanchev@pivotal.io) in October 2015 (commit 2bd1daa75e) and was already included in the upstream Spring 5.3.20 release (May 2022) before TuxCare onboarding. The complete RFD defense is active in AbstractMessageConverterMethodProcessor: SAFE_EXTENSIONS whitelist, addContentDispositionHeader() method that validates file extensions and adds Content-Disposition headers for unsafe extensions, preventing browser execution of malicious content.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:59.012677+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. Target is NOT AFFECTED. The fix for CVE-2016-5007 was already present in upstream Spring Framework 5.3.20 before TuxCare onboarded it. The vulnerability concerns pattern matching discrepancies between Spring Security authorization checks and Spring MVC request routing. The upstream fix (commit a30ab30e4e by rstoyanchev@pivotal.io) introduced HandlerMappingIntrospector API and MatchableHandlerMapping interface, which provide an introspection mechanism allowing Spring Security to use the exact same path matching logic as Spring MVC, eliminating discrepancies. All required classes and implementations are present in the target at the correct locations with functional match() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Target is NOT AFFECTED. The fix for CVE-2016-5007 was already present in upstream Spring Framework 5.3.20 before TuxCare onboarded it. The vulnerability concerns pattern matching discrepancies between Spring Security authorization checks and Spring MVC request routing. The upstream fix (commit a30ab30e4e by rstoyanchev@pivotal.io) introduced HandlerMappingIntrospector API and MatchableHandlerMapping interface, which provide an introspection mechanism allowing Spring Security to use the exact same path matching logic as Spring MVC, eliminating discrepancies. All required classes and implementations are present in the target at the correct locations with functional match() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:59:38.365541+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 where JSONP support was enabled by default via MappingJackson2JsonView. The target version 5.3.20 is not affected because JSONP support was completely removed in upstream Spring Framework 5.1.0 (commit ac37b678a3, June 2018), which predates the 5.3.20 release. The vulnerable code pattern\u2014automatic JSONP wrapping via \"jsonp\" and \"callback\" query parameters\u2014does not exist in the target codebase. This removal was an upstream fix by the Spring team, already present in the 5.3.20 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 where JSONP support was enabled by default via MappingJackson2JsonView. The target version 5.3.20 is not affected because JSONP support was completely removed in upstream Spring Framework 5.1.0 (commit ac37b678a3, June 2018), which predates the 5.3.20 release. The vulnerable code pattern\u2014automatic JSONP wrapping via \"jsonp\" and \"callback\" query parameters\u2014does not exist in the target codebase. This removal was an upstream fix by the Spring team, already present in the 5.3.20 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:13:00.113752+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.20 is not affected by CVE-2018-1199. The vulnerability fix was already present in the upstream Spring Framework 5.3.20 release that TuxCare onboarded. The defense code includes processPath() which normalizes backslashes to forward slashes and collapses duplicate slashes, plus isInvalidEncodedPath() which decodes paths and checks for traversal patterns. These prot...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.20 is not affected by CVE-2018-1199. The vulnerability fix was already present in the upstream Spring Framework 5.3.20 release that TuxCare onboarded. The defense code includes processPath() which normalizes backslashes to forward slashes and collapses duplicate slashes, plus isInvalidEncodedPath() which decodes paths and checks for traversal patterns. These prot..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 (ReDoS via malicious STOMP selector header) is not present in Spring Framework 5.3.20. The fix was introduced by upstream Spring in commit ff2228fdaf (April 2018, by rstoyanchev@pivotal.io) and was already included in the upstream v5.3.20 release. The fix adds the ability to disable selector header processing by setting the header name to null, preventing the expression parser fro...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 (ReDoS via malicious STOMP selector header) is not present in Spring Framework 5.3.20. The fix was introduced by upstream Spring in commit ff2228fdaf (April 2018, by rstoyanchev@pivotal.io) and was already included in the upstream v5.3.20 release. The fix adds the ability to disable selector header processing by setting the header name to null, preventing the expression parser fro..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 (Spring Framework authorization bypass via proxy method resolution) is NOT present in target version 5.3.20. Both upstream fix commits (aa11721ff0 and eaff2c28a7) authored by jhoeller@pivotal.io are present in HEAD's ancestry and were applied BEFORE the first TuxCare commit (150359d7c4), meaning the fix was already included in the upstream Spring Framework 5.3.20 release that TuxCare onboarded. The vulnerable pattern (excluding proxy classes from method resolution) does not exist in the codebase. The fix correctly handles proxy classes to ensure security annotations are retrieved from the underlying interface/class methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 (Spring Framework authorization bypass via proxy method resolution) is NOT present in target version 5.3.20. Both upstream fix commits (aa11721ff0 and eaff2c28a7) authored by jhoeller@pivotal.io are present in HEAD's ancestry and were applied BEFORE the first TuxCare commit (150359d7c4), meaning the fix was already included in the upstream Spring Framework 5.3.20 release that TuxCare onboarded. The vulnerable pattern (excluding proxy classes from method resolution) does not exist in the codebase. The fix correctly handles proxy classes to ensure security annotations are retrieved from the underlying interface/class methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:00:21.611953+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework version 5.3.20 is NOT vulnerable to CVE-2018-1271. The vulnerability was a Windows-specific directory traversal attack via backslash characters and URL-encoded path sequences in static resource requests. The fix (converting backslashes to forward slashes and checking for both \"../\" and \"..\\\\\" patterns) was authored by upstream Spring developer Juergen Hoeller on 2018...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework version 5.3.20 is NOT vulnerable to CVE-2018-1271. The vulnerability was a Windows-specific directory traversal attack via backslash characters and URL-encoded path sequences in static resource requests. The fix (converting backslashes to forward slashes and checking for both \"../\" and \"..\\\\\" patterns) was authored by upstream Spring developer Juergen Hoeller on 2018..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.20 is not affected by CVE-2018-1272. The vulnerability concerned predictable multipart boundary generation using java.util.Random in versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version 5.3.20 already contains the upstream fix (commit 847202c8f8e, June 2018) which uses SecureRandom with lazy initialization. This fix was part of the upstream Spring Framework 5.3.20 release and predates all TuxCare work on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 5.3.20 is not affected by CVE-2018-1272. The vulnerability concerned predictable multipart boundary generation using java.util.Random in versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version 5.3.20 already contains the upstream fix (commit 847202c8f8e, June 2018) which uses SecureRandom with lazy initialization. This fix was part of the upstream Spring Framework 5.3.20 release and predates all TuxCare work on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:43:26.013143+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. CVE-2018-15756 does not affect Spring Framework 5.3.20. The vulnerability (denial of service via malicious Range headers with excessive ranges or overlapping ranges) was fixed by upstream Spring developers in October 2018. The fix added two defenses: (1) a maximum limit of 100 ranges per request, and (2) validation that the sum of multiple ranges does not exceed the resource length. Both defenses are present in the target at spring-web/src/main/java/org/springframework/http/HttpRange.java (lines 48, 136-138, 185-195). The fix commit (423aa28ed5 by rstoyanchev@pivotal.io) is an ancestor of HEAD and predates the first TuxCare commit in this branch's history, confirming the fix shipped with the upstream 5.3.20 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 does not affect Spring Framework 5.3.20. The vulnerability (denial of service via malicious Range headers with excessive ranges or overlapping ranges) was fixed by upstream Spring developers in October 2018. The fix added two defenses: (1) a maximum limit of 100 ranges per request, and (2) validation that the sum of multiple ranges does not exceed the resource length. Both defenses are present in the target at spring-web/src/main/java/org/springframework/http/HttpRange.java (lines 48, 136-138, 185-195). The fix commit (423aa28ed5 by rstoyanchev@pivotal.io) is an ancestor of HEAD and predates the first TuxCare commit in this branch's history, confirming the fix shipped with the upstream 5.3.20 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:49:10.707680+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection vulnerability) is NOT present in Spring Framework 5.3.20. The upstream fix (commit e9083d7d20 by Rossen Stoyanchev from VMware, dated 2021-12-09) was already included in the Spring Framework 5.3.20 release (2022-05-11). All 10 files modified by the security patch contain the proper defenses: user-controlled input in log statements is wrapped with LogFormatUtils.for...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection vulnerability) is NOT present in Spring Framework 5.3.20. The upstream fix (commit e9083d7d20 by Rossen Stoyanchev from VMware, dated 2021-12-09) was already included in the Spring Framework 5.3.20 release (2022-05-11). All 10 files modified by the security patch contain the proper defenses: user-controlled input in log statements is wrapped with LogFormatUtils.for..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:36:46.495757+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.20-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.20. The upstream fix was applied in December 2021 (commits 99c7608ffe and e9083d7d20) and first shipped in version 5.3.14. The target version 5.3.20 includes this fix as part of the upstream release. The vulnerability pattern (unfiltered user input in log statements) is not present - all user-co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.20. The upstream fix was applied in December 2021 (commits 99c7608ffe and e9083d7d20) and first shipped in version 5.3.14. The target version 5.3.20 includes this fix as part of the upstream release. The vulnerability pattern (unfiltered user input in log statements) is not present - all user-co..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.3.20-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.3.20-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T15:09:07.027689+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.20-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.20-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T15:09:07.027689+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.20-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}