{
  "@id": "urn:uuid:1936e855-1dda-44e0-b34a-4074a728c787",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 52,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:33:04.564923+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:23:00.212716+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes a ReDoS vulnerability where deserializing Spring Framework objects containing regex patterns would trigger Pattern.compile() with attacker-controlled patterns, causing CPU exhaustion. The vulnerable code pattern was removed by upstream Spring Framework in commit 9306d6dbaa (April 20, 2009) by changing the serialization mechanism: Pattern fields are no longer transient, a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes a ReDoS vulnerability where deserializing Spring Framework objects containing regex patterns would trigger Pattern.compile() with attacker-controlled patterns, causing CPU exhaustion. The vulnerable code pattern was removed by upstream Spring Framework in commit 9306d6dbaa (April 20, 2009) by changing the serialization mechanism: Pattern fields are no longer transient, a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:33:04.564923+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.25 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.25 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:45:17.985105+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.25-tuxcare.11 is not affected by CVE-2011-2894. The vulnerability was fixed by upstream Spring Framework in version 3.0.6 (July 2011) via commit 070a723ef2 by jhoeller@vmware.com, which added the acceptProxyClasses flag to prevent deserialization of malicious Java Proxy objects. By the time version 5.3.25 was released in 2022, this fix had been present in the cod...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.25-tuxcare.11 is not affected by CVE-2011-2894. The vulnerability was fixed by upstream Spring Framework in version 3.0.6 (July 2011) via commit 070a723ef2 by jhoeller@vmware.com, which added the acceptProxyClasses flag to prevent deserialization of malicious Java Proxy objects. By the time version 5.3.25 was released in 2022, this fix had been present in the cod..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.25-tuxcare.11. The directory traversal vulnerability was fixed by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev @gopivotal.com on May 15, 2014), which added a check to prevent misinterpretation of in-path colons as URI scheme separators. This fix was already present in upstream Spring Framework 5.3.25...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.25-tuxcare.11. The directory traversal vulnerability was fixed by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev @gopivotal.com on May 15, 2014), which added a check to prevent misinterpretation of in-path colons as URI scheme separators. This fix was already present in upstream Spring Framework 5.3.25..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:13:01.149696+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The vulnerability was fixed in Spring Framework 4.1.5 (January 2015) by upstream commit 52b8f34468, which replaced the predictable AlternativeJdkIdGenerator with the cryptographically secure JdkIdGenerator. The target version 5.3.25 already contains this upstream fix. The vul...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the SockJS client. The vulnerability was fixed in Spring Framework 4.1.5 (January 2015) by upstream commit 52b8f34468, which replaced the predictable AlternativeJdkIdGenerator with the cryptographically secure JdkIdGenerator. The target version 5.3.25 already contains this upstream fix. The vul..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:00:16.038874+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. Spring Framework 5.3.25 is not affected by CVE-2015-5211 (Reflected File Download attack). The upstream RFD protection fix from October 2015 (commit 2bd1daa75e) was already present in the 5.3.25 release when TuxCare onboarded it. Additionally, JSONP support (a key attack vector) was completely removed in Spring 5.0 (June 2018). The target contains multiple defenses: (1) UriUtils.extractFileExtension() properly strips query/fragment parameters before extracting file extensions, (2) JSONP functionality completely absent, (3) SockJS path validation rejects malicious path parameters. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 5.3.25 is not affected by CVE-2015-5211 (Reflected File Download attack). The upstream RFD protection fix from October 2015 (commit 2bd1daa75e) was already present in the 5.3.25 release when TuxCare onboarded it. Additionally, JSONP support (a key attack vector) was completely removed in Spring 5.0 (June 2018). The target contains multiple defenses: (1) UriUtils.extractFileExtension() properly strips query/fragment parameters before extracting file extensions, (2) JSONP functionality completely absent, (3) SockJS path validation rejects malicious path parameters. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:13:11.896857+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. Spring Framework 5.3.25 is not affected by CVE-2016-5007. The vulnerability, which involves URL pattern matching inconsistencies between Spring Security and Spring MVC that can lead to authorization bypass, was fixed in the upstream release. The fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5, dated 2016-04-25) introduced the HandlerMappingIntrospector API that allows Spring Security to use the exact same pattern matching logic as Spring MVC, eliminating the discrepancies. This fix was already present in Spring Framework 5.3.25 when TuxCare onboarded it on 2026-04-24, making it an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.3.25 is not affected by CVE-2016-5007. The vulnerability, which involves URL pattern matching inconsistencies between Spring Security and Spring MVC that can lead to authorization bypass, was fixed in the upstream release. The fix (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5, dated 2016-04-25) introduced the HandlerMappingIntrospector API that allows Spring Security to use the exact same pattern matching logic as Spring MVC, eliminating the discrepancies. This fix was already present in Spring Framework 5.3.25 when TuxCare onboarded it on 2026-04-24, making it an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:54:41.040148+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. Spring Framework 5.3.25 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed from Spring Framework in version 5.1.0 (June 2018), well before the 5.3.25 release. The target repository contains no JSONP-related code: no jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, no JSONP parameter processing methods. The removal was an upstream fix (commit ac37b678a3 by sdeleuze@pivotal.io) that shipped in the upstream v5.3.25 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.25 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed from Spring Framework in version 5.1.0 (June 2018), well before the 5.3.25 release. The target repository contains no JSONP-related code: no jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, no JSONP parameter processing methods. The removal was an upstream fix (commit ac37b678a3 by sdeleuze@pivotal.io) that shipped in the upstream v5.3.25 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:03:00.096337+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.3.25-tuxcare.11. The vulnerability allowed attackers to bypass security constraints using specially encoded URL path parameters and separators. The complete upstream fix was already included in Spring Framework 5.3.25 when TuxCare onboarded it. The target contains both defensive layers: (1) UrlPathHelper removes semicolon-delimited matrix param...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is NOT present in Spring Framework 5.3.25-tuxcare.11. The vulnerability allowed attackers to bypass security constraints using specially encoded URL path parameters and separators. The complete upstream fix was already included in Spring Framework 5.3.25 when TuxCare onboarded it. The target contains both defensive layers: (1) UrlPathHelper removes semicolon-delimited matrix param..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T09:10:31.335583+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 ReDoS vulnerability is not present in Spring Framework 5.3.25. The fix (commit ff2228fdaf from April 2018) was already included in the upstream release. The vulnerable pattern - mandatory selector header parsing without ability to disable - has been replaced with configurable selector support where setSelectorHeaderName(null) disables the feature, and getSelectorExpression() check...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 ReDoS vulnerability is not present in Spring Framework 5.3.25. The fix (commit ff2228fdaf from April 2018) was already included in the upstream release. The vulnerable pattern - mandatory selector header parsing without ability to disable - has been replaced with configurable selector support where setSelectorHeaderName(null) disables the feature, and getSelectorExpression() check..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. Spring Framework 5.3.25-tuxcare.11 is not affected by CVE-2018-1258. The authorization bypass vulnerability in proxy method resolution was fixed in upstream Spring Framework commit aa11721ff0f7bf146099696e576c0a37d83603eb (authored by jhoeller@pivotal.io) and was already present in the 5.3.25 release that TuxCare onboarded. The vulnerable code pattern (the `!Proxy.isProxyClass(targetClass)` check that caused method security annotations to be bypassed) is absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.3.25-tuxcare.11 is not affected by CVE-2018-1258. The authorization bypass vulnerability in proxy method resolution was fixed in upstream Spring Framework commit aa11721ff0f7bf146099696e576c0a37d83603eb (authored by jhoeller@pivotal.io) and was already present in the 5.3.25 release that TuxCare onboarded. The vulnerable code pattern (the `!Proxy.isProxyClass(targetClass)` check that caused method security annotations to be bypassed) is absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:37:22.146734+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 describes a directory traversal vulnerability in Spring Framework when serving static resources from Windows file systems. Attackers could use URL-encoded path segments (e.g., %2E%2E%2F for ../) to bypass traversal checks. The target version 5.3.25-tuxcare.11 is NOT AFFECTED because the upstream fix was already present in Spring Framework 5.3.25 when TuxCare onboarded it. The fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 describes a directory traversal vulnerability in Spring Framework when serving static resources from Windows file systems. Attackers could use URL-encoded path segments (e.g., %2E%2E%2F for ../) to bypass traversal checks. The target version 5.3.25-tuxcare.11 is NOT AFFECTED because the upstream fix was already present in Spring Framework 5.3.25 when TuxCare onboarded it. The fix ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. Target Spring Framework 5.3.25 is NOT AFFECTED by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak Random(), enabling attackers to inject fake boundaries and manipulate part values. The target uses SecureRandom() with lazy initialization (introduced upstream in 2018) for cryptographically unpredictable boundary generation. This fix was already present in the upstream Spring Framework 5.3.25 release that TuxCare onboarded in 2026. The vulnerable code pattern (new Random()) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Target Spring Framework 5.3.25 is NOT AFFECTED by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak Random(), enabling attackers to inject fake boundaries and manipulate part values. The target uses SecureRandom() with lazy initialization (introduced upstream in 2018) for cryptographically unpredictable boundary generation. This fix was already present in the upstream Spring Framework 5.3.25 release that TuxCare onboarded in 2026. The vulnerable code pattern (new Random()) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 is not present in Spring Framework 5.3.25. The vulnerability affects older versions (5.1, 5.0.x prior to 5.0.10, 4.3.x prior to 4.3.20, and 4.2.x). The fix was introduced by upstream Spring Framework in October 2018 (commit 423aa28ed5 by rstoyanchev@pivotal.io) and was already present in the upstream 5.3.25 release when TuxCare onboarded it in commit 77838bb86b. Both required defenses are present in the target: MAX_RANGES=100 limit (line 48) and sum-of-ranges validation (lines 185-195) in HttpRange.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is not present in Spring Framework 5.3.25. The vulnerability affects older versions (5.1, 5.0.x prior to 5.0.10, 4.3.x prior to 4.3.20, and 4.2.x). The fix was introduced by upstream Spring Framework in October 2018 (commit 423aa28ed5 by rstoyanchev@pivotal.io) and was already present in the upstream 5.3.25 release when TuxCare onboarded it in commit 77838bb86b. Both required defenses are present in the target: MAX_RANGES=100 limit (line 48) and sum-of-ranges validation (lines 185-195) in HttpRange.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:26:54.527306+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 is not present in Spring Framework 5.3.25-tuxcare.11. The vulnerability (log injection via newlines and control characters) was fixed in upstream Spring Framework v5.3.14 by commit 99c7608ffe. The target version 5.3.25 already includes this upstream fix, which adds regex-based sanitization in LogFormatUtils.formatValue() that replaces newlines with <EOL> and control characters wi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 is not present in Spring Framework 5.3.25-tuxcare.11. The vulnerability (log injection via newlines and control characters) was fixed in upstream Spring Framework v5.3.14 by commit 99c7608ffe. The target version 5.3.25 already includes this upstream fix, which adds regex-based sanitization in LogFormatUtils.formatValue() that replaces newlines with <EOL> and control characters wi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T21:23:33.596667+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.25-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via malicious input containing newlines/control characters) is NOT present in Spring Framework 5.3.25-tuxcare.11. The upstream vendor (VMware/Spring) fixed this vulnerability in commits 99c7608ffe and e9083d7d by adding newline and control character sanitization to LogFormatUtils and applying it across logging call sites. Both fix commits were already included in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via malicious input containing newlines/control characters) is NOT present in Spring Framework 5.3.25-tuxcare.11. The upstream vendor (VMware/Spring) fixed this vulnerability in commits 99c7608ffe and e9083d7d by adding newline and control character sanitization to LogFormatUtils and applying it across logging call sites. Both fix commits were already included in t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T03:39:22.988337+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.3.25-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.3.25-tuxcare.1 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.25-tuxcare.1 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.25-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.25-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.3.25-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.25-tuxcare.1 of org.springframework:spring-core, and is fixed in 5.3.25-tuxcare.9."
    }
  ]
}