{
  "@id": "urn:uuid:cfc9a1fd-72f2-4fba-a704-34805134afab",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:23:42.223331+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 affects java.util.regex.Pattern.compile in JDK before 1.6 (JDK 1.5 and earlier). Spring Framework 5.3.23 requires JDK 8+ as its baseline runtime environment (confirmed in documentation: \"Spring requires JDK 8+ (Java SE 8+)\"). While the code pattern exists (PatternEditor calls Pattern.compile without Spring-level validation), the underlying JDK algorithmic complexity vulnerability ...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 affects java.util.regex.Pattern.compile in JDK before 1.6 (JDK 1.5 and earlier). Spring Framework 5.3.23 requires JDK 8+ as its baseline runtime environment (confirmed in documentation: \"Spring requires JDK 8+ (Java SE 8+)\"). While the code pattern exists (PatternEditor calls Pattern.compile without Spring-level validation), the underlying JDK algorithmic complexity vulnerability ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T17:35:07.559890+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.23 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 62ccc8dd, 9772eb84, b8d86330). Version 5.3.23 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T09:43:37.074687+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2011-2894 fix was already present in the upstream Spring Framework 5.3.23 release that TuxCare onboarded. The target contains the complete mitigation: acceptProxyClasses flag in ConfigurableObjectInputStream with validation in resolveProxyClass() that throws NotSerializableException when proxy class deserialization is disabled. This fix was authored by Juergen Hoeller (jhoeller@vmware.com) ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 fix was already present in the upstream Spring Framework 5.3.23 release that TuxCare onboarded. The target contains the complete mitigation: acceptProxyClasses flag in ConfigurableObjectInputStream with validation in resolveProxyClass() that throws NotSerializableException when proxy class deserialization is disabled. This fix was authored by Juergen Hoeller (jhoeller@vmware.com) ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.23-tuxcare.4. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already included in the upstream release that TuxCare onboarded, authored by rstoyanchev@gopivotal.com. The fix in StringUtils.cleanPath() at lines 705-707 rejects colons appearing after slashes as prefix delimiters, preventing directory traversal attacks via...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.23-tuxcare.4. The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66) was already included in the upstream release that TuxCare onboarded, authored by rstoyanchev@gopivotal.com. The fix in StringUtils.cleanPath() at lines 705-707 rejects colons appearing after slashes as prefix delimiters, preventing directory traversal attacks via..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:12:40.262944+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in version 4.1.5 (January 2015) by replacing AlternativeJdkIdGenerator (which used predictable java.util.Random after initial seeding) with JdkIdGenerator (which uses cryptographically random UUID.randomUUID()). The target version 5.3.23-tuxca...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The vulnerability was fixed in version 4.1.5 (January 2015) by replacing AlternativeJdkIdGenerator (which used predictable java.util.Random after initial seeding) with JdkIdGenerator (which uses cryptographically random UUID.randomUUID()). The target version 5.3.23-tuxca..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:02:11.032230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack in Spring Framework 3.x/4.x) is NOT present in the target version 5.3.23. The upstream vendor fix (commit 2bd1daa75e from October 2015) is already included in Spring Framework 5.3.23, which was released in 2022. All RFD protection mechanisms are present: (1) Content-Disposition header injection for unsafe file extensions, (2) SAFE_EXTENSIONS whitelist validation, (3) path parameter (semicolon) handling to prevent bypass attacks, (4) SockJS path validation, and (5) callback parameter validation. The fix was authored by Pivotal/VMware engineers and shipped in upstream Spring Framework 4.2.2+ and all 5.x versions, predating TuxCare's maintenance of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack in Spring Framework 3.x/4.x) is NOT present in the target version 5.3.23. The upstream vendor fix (commit 2bd1daa75e from October 2015) is already included in Spring Framework 5.3.23, which was released in 2022. All RFD protection mechanisms are present: (1) Content-Disposition header injection for unsafe file extensions, (2) SAFE_EXTENSIONS whitelist validation, (3) path parameter (semicolon) handling to prevent bypass attacks, (4) SockJS path validation, and (5) callback parameter validation. The fix was authored by Pivotal/VMware engineers and shipped in upstream Spring Framework 4.2.2+ and all 5.x versions, predating TuxCare's maintenance of this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:14:44.515379+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. CVE-2016-5007 is not present in Spring Framework 5.3.23. The vulnerability required the ABSENCE of a unified pattern matching API that would allow Spring Security to use Spring MVC's exact URL matching logic. The fix (HandlerMappingIntrospector + MatchableHandlerMapping interface) was introduced by upstream Spring in v4.3.1.RELEASE (April 2016) and has been present in all 5.x versions. The target version 5.3.23 shipped with this fix already integrated from upstream, eliminating the pattern matching discrepancy vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is not present in Spring Framework 5.3.23. The vulnerability required the ABSENCE of a unified pattern matching API that would allow Spring Security to use Spring MVC's exact URL matching logic. The fix (HandlerMappingIntrospector + MatchableHandlerMapping interface) was introduced by upstream Spring in v4.3.1.RELEASE (April 2016) and has been present in all 5.x versions. The target version 5.3.23 shipped with this fix already integrated from upstream, eliminating the pattern matching discrepancy vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:56:41.543674+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. Spring Framework 5.3.23 is NOT affected by CVE-2018-11040. The vulnerability concerns automatic JSONP (JSON with Padding) support enabled by default in MappingJackson2JsonView via \"jsonp\" and \"callback\" query parameters. The upstream vendor (Pivotal/Spring) completely removed all JSONP functionality in Spring Framework 5.1.0 (commit ac37b678a3, June 2018). The target version 5.3.23 inherited this removal from the upstream release - JSONP support does not exist at all. Key evidence: (1) MappingJackson2JsonView has no jsonpParameterNames field, (2) MappingJacksonValue has no jsonpFunction field or methods, (3) AbstractJsonpResponseBodyAdvice class does not exist, (4) no JSONP-related code found anywhere in the codebase. The fix was authored by Sebastien Deleuze (sdeleuze@pivotal.io) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.23 is NOT affected by CVE-2018-11040. The vulnerability concerns automatic JSONP (JSON with Padding) support enabled by default in MappingJackson2JsonView via \"jsonp\" and \"callback\" query parameters. The upstream vendor (Pivotal/Spring) completely removed all JSONP functionality in Spring Framework 5.1.0 (commit ac37b678a3, June 2018). The target version 5.3.23 inherited this removal from the upstream release - JSONP support does not exist at all. Key evidence: (1) MappingJackson2JsonView has no jsonpParameterNames field, (2) MappingJacksonValue has no jsonpFunction field or methods, (3) AbstractJsonpResponseBodyAdvice class does not exist, (4) no JSONP-related code found anywhere in the codebase. The fix was authored by Sebastien Deleuze (sdeleuze@pivotal.io) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T01:04:00.220847+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 affects Spring Framework's handling of URL path parameters with special encodings that could bypass security constraints. The target (Spring Framework 5.3.23-tuxcare.4) is NOT affected because the upstream fix was already present in the 5.3.23 release. The fix normalizes paths by replacing backslashes with forward slashes, collapsing duplicate slashes, and validating decoded paths...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 affects Spring Framework's handling of URL path parameters with special encodings that could bypass security constraints. The target (Spring Framework 5.3.23-tuxcare.4) is NOT affected because the upstream fix was already present in the 5.3.23 release. The fix normalizes paths by replacing backslashes with forward slashes, collapsing duplicate slashes, and validating decoded paths..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2018-1257. The vulnerability affects versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target version (5.3.23, released 2022) is well beyond the fixed versions and contains the upstream fix that allows disabling selector header processing to prevent ReDoS attacks. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in Apri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2018-1257. The vulnerability affects versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target version (5.3.23, released 2022) is well beyond the fixed versions and contains the upstream fix that allows disabling selector header processing to prevent ReDoS attacks. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in Apri..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework's method security when using JDK dynamic proxies. The vulnerability allowed authorization bypass because security annotations were evaluated on proxy methods (which lack annotations) instead of target methods. The target version 5.3.23-tuxcare.4 is NOT affected - the upstream fix was already present in the base release that TuxCare onboarded. Two fix commits (eaff2c28a7 and aa11721ff0) by upstream author Juergen Hoeller were applied on 2018-04-27, well before the first TuxCare commit on this branch. The fixes ensure correct method resolution by checking Proxy.isProxyClass() before calling getMostSpecificMethod(), guaranteeing security annotations are found and evaluated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework's method security when using JDK dynamic proxies. The vulnerability allowed authorization bypass because security annotations were evaluated on proxy methods (which lack annotations) instead of target methods. The target version 5.3.23-tuxcare.4 is NOT affected - the upstream fix was already present in the base release that TuxCare onboarded. Two fix commits (eaff2c28a7 and aa11721ff0) by upstream author Juergen Hoeller were applied on 2018-04-27, well before the first TuxCare commit on this branch. The fixes ensure correct method resolution by checking Proxy.isProxyClass() before calling getMostSpecificMethod(), guaranteeing security annotations are found and evaluated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2018-1271 (directory traversal on Windows file systems). The vulnerability was fixed in upstream Spring Framework versions 5.0.5 and 4.3.15 (released March 2018). Version 5.3.23 is a much later release that already includes the complete fix. The defense mechanisms are present in the target: (1) processPath() normalizes backslashes to forward slashe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2018-1271 (directory traversal on Windows file systems). The vulnerability was fixed in upstream Spring Framework versions 5.0.5 and 4.3.15 (released March 2018). Version 5.3.23 is a much later release that already includes the complete fix. The defense mechanisms are present in the target: (1) processPath() normalizes backslashes to forward slashe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15 due to predictable multipart boundary generation using java.util.Random, allowing boundary injection attacks. The target version 5.3.23 is NOT AFFECTED because the fix (using SecureRandom instead of Random) was already present in the upstream Spring Framework release. The fix commit ab2410c754 by rstoyanchev@pivotal.io (2018-03-23) introduced \"private static final Random RND = new SecureRandom();\" which was later refactored to lazy initialization. Current code at HEAD uses \"new SecureRandom()\" in initRandom() method (line 393 of MimeTypeUtils.java). The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15 due to predictable multipart boundary generation using java.util.Random, allowing boundary injection attacks. The target version 5.3.23 is NOT AFFECTED because the fix (using SecureRandom instead of Random) was already present in the upstream Spring Framework release. The fix commit ab2410c754 by rstoyanchev@pivotal.io (2018-03-23) introduced \"private static final Random RND = new SecureRandom();\" which was later refactored to lazy initialization. Current code at HEAD uses \"new SecureRandom()\" in initRandom() method (line 393 of MimeTypeUtils.java). The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:39:12.146709+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. CVE-2018-15756 (HTTP Range DoS vulnerability) was fixed in upstream Spring Framework 5.1.1.RELEASE (October 2018) via commit 423aa28ed5. The fix adds two protections: (1) limits HTTP Range requests to maximum 100 ranges, and (2) validates that the sum of all range byte counts doesn't exceed resource length to prevent overlapping ranges. Both protections are present in the target Spring Framework 5.3.23 at HEAD (81dbd4fbb1). This is an upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) that shipped in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 (HTTP Range DoS vulnerability) was fixed in upstream Spring Framework 5.1.1.RELEASE (October 2018) via commit 423aa28ed5. The fix adds two protections: (1) limits HTTP Range requests to maximum 100 ranges, and (2) validates that the sum of all range byte counts doesn't exceed resource length to prevent overlapping ranges. Both protections are present in the target Spring Framework 5.3.23 at HEAD (81dbd4fbb1). This is an upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) that shipped in the upstream release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 is NOT present in Spring Framework 5.3.23. The vulnerability affects versions 5.3.0-5.3.13, but the target is at 5.3.23 which includes the upstream fix from Spring Framework 5.3.14. All defense mechanisms (LogFormatUtils with newline and control character sanitization) are present and properly applied throughout the codebase. The fix was authored by upstream Spring developers (rs...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 is NOT present in Spring Framework 5.3.23. The vulnerability affects versions 5.3.0-5.3.13, but the target is at 5.3.23 which includes the upstream fix from Spring Framework 5.3.14. All defense mechanisms (LogFormatUtils with newline and control character sanitization) are present and properly applied throughout the codebase. The fix was authored by upstream Spring developers (rs..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2021-22096 (log injection vulnerability). The upstream vendor fix is already present in this version. The CVE affected versions 5.3.0-5.3.10; Spring Framework fixed it in 5.3.11, and version 5.3.23 inherited the complete fix from upstream. The fix consists of LogFormatUtils.formatValue() sanitization (replacing newlines with <EOL> and control chara...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2021-22096 (log injection vulnerability). The upstream vendor fix is already present in this version. The CVE affected versions 5.3.0-5.3.10; Spring Framework fixed it in 5.3.11, and version 5.3.23 inherited the complete fix from upstream. The fix consists of LogFormatUtils.formatValue() sanitization (replacing newlines with <EOL> and control chara..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:23:42.223331+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached URI comparison code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, handler mappings are resolved directly without consulting a cached result; the class has no vulnerable CachedResult implementation, so request URIs cannot reach the affected regular-expression comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached URI comparison code is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, handler mappings are resolved directly without consulting a cached result; the class has no vulnerable CachedResult implementation, so request URIs cannot reach the affected regular-expression comparison."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.23-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.23-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.23-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}