{
  "@id": "urn:uuid:37e0a537-fb64-4a7c-a415-6191253a1003",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 52,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:22:17.110385+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-30T11:55:34.415642+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in JDK Pattern.compile (before JDK 1.6) when exposed through Spring Framework's property binding. While Spring 5.3.29 retains PatternEditor code that calls Pattern.compile without Spring-level validation, the target is not affected because it requires JDK 8+ to run. All supported JDK versions include the algorithmic complexity fix fr...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in JDK Pattern.compile (before JDK 1.6) when exposed through Spring Framework's property binding. While Spring 5.3.29 retains PatternEditor code that calls Pattern.compile without Spring-level validation, the target is not affected because it requires JDK 8+ to run. All supported JDK versions include the algorithmic complexity fix fr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-06T17:28:28.319057+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.29 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.29 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T09:31:48.808270+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.29 is not affected by CVE-2011-2894. The vulnerability allowed remote attackers to execute untrusted code by deserializing malicious java.lang.Proxy instances with InvocationHandler. The upstream vendor (VMware/Pivotal) fixed this in July 2011 by adding an acceptProxyClasses flag to ConfigurableObjectInputStream that throws NotSerializableException when proxy class deserial...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.29 is not affected by CVE-2011-2894. The vulnerability allowed remote attackers to execute untrusted code by deserializing malicious java.lang.Proxy instances with InvocationHandler. The upstream vendor (VMware/Pivotal) fixed this in July 2011 by adding an acceptProxyClasses flag to ConfigurableObjectInputStream that throws NotSerializableException when proxy class deserial..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.29-tuxcare.12. The vulnerability involved directory traversal via crafted URLs with embedded colons (e.g., /a/:b/../../file) that exploited improper prefix handling in StringUtils.cleanPath(). The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66 by rstoyanchev@gopivotal.com) was already included in the Spring Framework 5.3.29 rel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 5.3.29-tuxcare.12. The vulnerability involved directory traversal via crafted URLs with embedded colons (e.g., /a/:b/../../file) that exploited improper prefix handling in StringUtils.cleanPath(). The upstream fix (commit 8ee465103850a3dca018273fe5952e40d5c45a66 by rstoyanchev@gopivotal.com) was already included in the Spring Framework 5.3.29 rel..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:00.096825+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 5.3.29-tuxcare.12 is not affected by CVE-2015-0201. The vulnerability concerned predictable session ID generation in the Java SockJS client (versions 4.1.x before 4.1.5). The fix was introduced in upstream commit 52b8f34468 (Jan 2015) by Rossen Stoyanchev, which replaced the predictable AlternativeJdkIdGenerator with JdkIdGenerator that uses UUID.randomUUID() for cry...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.29-tuxcare.12 is not affected by CVE-2015-0201. The vulnerability concerned predictable session ID generation in the Java SockJS client (versions 4.1.x before 4.1.5). The fix was introduced in upstream commit 52b8f34468 (Jan 2015) by Rossen Stoyanchev, which replaced the predictable AlternativeJdkIdGenerator with JdkIdGenerator that uses UUID.randomUUID() for cry..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T12:53:41.382779+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download) affects Spring Framework versions 3.2.0-3.2.14, 4.0.0-4.1.7, and 4.2.0-4.2.1. The target version 5.3.29 is significantly newer and already contains the upstream fix from October 2015 (commit 2bd1daa75e). The vulnerable code pattern is not present: path extension content negotiation is deprecated and disabled by default, and the vulnerable extractFullFilenameFromUrlPath method has been removed entirely. The fix was authored by the upstream Spring Framework team (rstoyanchev@pivotal.io) and was included in the upstream 5.3.29 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download) affects Spring Framework versions 3.2.0-3.2.14, 4.0.0-4.1.7, and 4.2.0-4.2.1. The target version 5.3.29 is significantly newer and already contains the upstream fix from October 2015 (commit 2bd1daa75e). The vulnerable code pattern is not present: path extension content negotiation is deprecated and disabled by default, and the vulnerable extractFullFilenameFromUrlPath method has been removed entirely. The fix was authored by the upstream Spring Framework team (rstoyanchev@pivotal.io) and was included in the upstream 5.3.29 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:06:00.441936+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. Spring Framework 5.3.29 is not affected by CVE-2016-5007. The vulnerability concerned URL pattern matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. The fix (MatchableHandlerMapping interface and HandlerMappingIntrospector) was introduced by upstream Spring Framework in commit a30ab30e4e on April 25, 2016 (issue SPR-14321), authored by Rossen Stoyanchev. This fix was already present in the upstream 5.3.29 release (July 2022) that TuxCare onboarded, so the vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 5.3.29 is not affected by CVE-2016-5007. The vulnerability concerned URL pattern matching discrepancies between Spring Security and Spring MVC that could allow authorization bypass. The fix (MatchableHandlerMapping interface and HandlerMappingIntrospector) was introduced by upstream Spring Framework in commit a30ab30e4e on April 25, 2016 (issue SPR-14321), authored by Rossen Stoyanchev. This fix was already present in the upstream 5.3.29 release (July 2022) that TuxCare onboarded, so the vulnerable pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:07.796693+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. CVE-2018-11040 affects Spring Framework 4.3.x < 4.3.18 and 5.0.x < 5.0.7, where JSONP support was automatically enabled via default parameter names \"jsonp\" and \"callback\" in MappingJackson2JsonView. The target version 5.3.29 is NOT affected because JSONP support was completely removed in Spring Framework 5.1 (June 2018, commit ac37b678a3). The vulnerable code pattern does not exist in the target: MappingJackson2JsonView has no jsonpParameterNames field or JSONP-related methods, AbstractJsonpResponseBodyAdvice class does not exist, and MappingJacksonValue has no setJsonpFunction/getJsonpFunction methods. The removal was part of the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "CVE-2018-11040 affects Spring Framework 4.3.x < 4.3.18 and 5.0.x < 5.0.7, where JSONP support was automatically enabled via default parameter names \"jsonp\" and \"callback\" in MappingJackson2JsonView. The target version 5.3.29 is NOT affected because JSONP support was completely removed in Spring Framework 5.1 (June 2018, commit ac37b678a3). The vulnerable code pattern does not exist in the target: MappingJackson2JsonView has no jsonpParameterNames field or JSONP-related methods, AbstractJsonpResponseBodyAdvice class does not exist, and MappingJacksonValue has no setJsonpFunction/getJsonpFunction methods. The removal was part of the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T00:52:21.627845+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 Target Spring Framework 5.3.29-tuxcare.12 is not affected by CVE-2018-1199. The vulnerability allowed bypassing security constraints via URL path manipulation (duplicate slashes, backslashes, encoded traversal sequences). Upstream Spring developers (jhoeller@pivotal.io, rstoyanchev@pivotal.io) fixed this in commits 91b803a231, 0e28bee0f1, ea73ec5c41 (SPR-16616, SPR-16296), which shipped in upst...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Target Spring Framework 5.3.29-tuxcare.12 is not affected by CVE-2018-1199. The vulnerability allowed bypassing security constraints via URL path manipulation (duplicate slashes, backslashes, encoded traversal sequences). Upstream Spring developers (jhoeller@pivotal.io, rstoyanchev@pivotal.io) fixed this in commits 91b803a231, 0e28bee0f1, ea73ec5c41 (SPR-16616, SPR-16296), which shipped in upst..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-30T08:49:57.907521+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. Spring Framework 5.3.29 is not affected by CVE-2018-1258. The vulnerability (authorization bypass due to incorrect proxy method resolution when using method security) was fixed upstream in April 2018 through commits aa11721ff0 (SPR-16757) and eaff2c28a7 (SPR-16779), both authored by upstream Spring maintainer Juergen Hoeller. These fixes were already present in the Spring 5.3.29 release that TuxCare onboarded in November 2025. All affected files (AopUtils.java, CacheAspectSupport.java, EventExpressionEvaluator.java, AnnotationMethodMatcher.java) contain the corrected proxy method resolution logic that prevents the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 5.3.29 is not affected by CVE-2018-1258. The vulnerability (authorization bypass due to incorrect proxy method resolution when using method security) was fixed upstream in April 2018 through commits aa11721ff0 (SPR-16757) and eaff2c28a7 (SPR-16779), both authored by upstream Spring maintainer Juergen Hoeller. These fixes were already present in the Spring 5.3.29 release that TuxCare onboarded in November 2025. All affected files (AopUtils.java, CacheAspectSupport.java, EventExpressionEvaluator.java, AnnotationMethodMatcher.java) contain the corrected proxy method resolution logic that prevents the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-30T18:20:00.320036+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 The target repository (Spring Framework 5.3.29-tuxcare.12) is not affected by CVE-2018-1271 (directory traversal vulnerability in static resource serving on Windows). The vulnerability was fixed in the upstream Spring Framework release, well before version 5.3.29. The fix was authored by Juergen Hoeller (jhoeller@pivotal.io) in commit 91b803a2 (March 2018), which introduced the isInvalidEncoded...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Framework 5.3.29-tuxcare.12) is not affected by CVE-2018-1271 (directory traversal vulnerability in static resource serving on Windows). The vulnerability was fixed in the upstream Spring Framework release, well before version 5.3.29. The fix was authored by Juergen Hoeller (jhoeller@pivotal.io) in commit 91b803a2 (March 2018), which introduced the isInvalidEncoded..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version 5.3.29-tuxcare.12 is not vulnerable. The vulnerability involved predictable multipart boundary generation using weak java.util.Random, allowing attackers to inject extra multipart content into forwarded requests. The fix (commit 847202c8f8, June 2018) replaced Random with SecureRandom, making boundaries cryptographically unpredictable. This upstream fix by Juergen Hoeller was already present in the v5.3.29 release before TuxCare onboarded it (first TuxCare commit: fa495141cb, Sep 2024). The target code at spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java (lines 387-398, 404-409) uses SecureRandom via lazy initialization in initRandom(), confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The target version 5.3.29-tuxcare.12 is not vulnerable. The vulnerability involved predictable multipart boundary generation using weak java.util.Random, allowing attackers to inject extra multipart content into forwarded requests. The fix (commit 847202c8f8, June 2018) replaced Random with SecureRandom, making boundaries cryptographically unpredictable. This upstream fix by Juergen Hoeller was already present in the v5.3.29 release before TuxCare onboarded it (first TuxCare commit: fa495141cb, Sep 2024). The target code at spring-core/src/main/java/org/springframework/util/MimeTypeUtils.java (lines 387-398, 404-409) uses SecureRandom via lazy initialization in initRandom(), confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:30:30.768655+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. Spring Framework 5.3.29-tuxcare.12 is not affected by CVE-2018-15756. The upstream vendor fix (commit 423aa28ed5 by rstoyanchev@pivotal.io, dated Oct 3, 2018) was already present in Spring Framework 5.3.29 before TuxCare onboarding. Both required defenses are active: (1) MAX_RANGES=100 limit in HttpRange.parseRanges() rejects requests with >100 ranges, and (2) sum validation in HttpRange.toResourceRegions() rejects multi-range requests where total range bytes >= resource length. The vulnerable pattern described in CVE-2018-15756 is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 5.3.29-tuxcare.12 is not affected by CVE-2018-15756. The upstream vendor fix (commit 423aa28ed5 by rstoyanchev@pivotal.io, dated Oct 3, 2018) was already present in Spring Framework 5.3.29 before TuxCare onboarding. Both required defenses are active: (1) MAX_RANGES=100 limit in HttpRange.parseRanges() rejects requests with >100 ranges, and (2) sum validation in HttpRange.toResourceRegions() rejects multi-range requests where total range bytes >= resource length. The vulnerable pattern described in CVE-2018-15756 is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-31T20:08:37.945680+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.29. The fix was already included in the upstream Spring Framework 5.3.29 release that TuxCare onboarded. Core defense mechanism (LogFormatUtils with NEWLINE_PATTERN and CONTROL_CHARACTER_PATTERN) is present and applied comprehensively across vulnerable logging locations. Both fix commits (99c760...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.29. The fix was already included in the upstream Spring Framework 5.3.29 release that TuxCare onboarded. Core defense mechanism (LogFormatUtils with NEWLINE_PATTERN and CONTROL_CHARACTER_PATTERN) is present and applied comprehensively across vulnerable logging locations. Both fix commits (99c760..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-31T21:11:37.152512+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) does not affect spring-framework 5.3.29. The vulnerability allowed attackers to inject fake log entries by providing input containing newline or control characters. The upstream fix (commit 99c7608f by rstoyanchev@vmware.com) was already included in the upstream Spring Framework 5.3.11+ release, which predates the 5.3.29 version tha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) does not affect spring-framework 5.3.29. The vulnerability allowed attackers to inject fake log entries by providing input containing newline or control characters. The upstream fix (commit 99c7608f by rstoyanchev@vmware.com) was already included in the upstream Spring Framework 5.3.11+ release, which predates the 5.3.29 version tha..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:17.110385+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, handler lookup resolves the handler directly using an attributes-preserving request wrapper; the class contains no CachedResult, request-result cache API, or URI-as-regex comparison.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached request-URI comparison is absent. In spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:184, handler lookup resolves the handler directly using an attributes-preserving request wrapper; the class contains no CachedResult, request-result cache API, or URI-as-regex comparison."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-15T22:22:00.154648+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.29-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-15T22:22:00.154648+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}