{
  "@id": "urn:uuid:41ee5fd1-c968-43f8-8dc7-77fdc6710293",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T12:28:00.064045+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:52:00.326096+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.3 is not affected by CVE-2009-1190. This CVE targets an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6. While Spring Framework 5.3.3 still compiles regex patterns without validation (in classes like UriTemplate and PatternEditor), it requires Java 8+ which includes the JDK-level fixes for this vulnerability. The protection is provi...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.3 is not affected by CVE-2009-1190. This CVE targets an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6. While Spring Framework 5.3.3 still compiles regex patterns without validation (in classes like UriTemplate and PatternEditor), it requires Java 8+ which includes the JDK-level fixes for this vulnerability. The protection is provi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:39:09.450487+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 5.3.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:49:00.106689+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.3 is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes) was fixed by upstream Spring in July 2011 (commit 070a723ef2) and included in version 3.0.6.RELEASE. Spring 5.3.3, released in 2020, already contains this fix from the upstream release. All three affected files (ConfigurableObjectInputStream.java, CodebaseAwareObjectInputStream.j...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.3 is not affected by CVE-2011-2894. The vulnerability (unsafe deserialization of proxy classes) was fixed by upstream Spring in July 2011 (commit 070a723ef2) and included in version 3.0.6.RELEASE. Spring 5.3.3, released in 2020, already contains this fix from the upstream release. All three affected files (ConfigurableObjectInputStream.java, CodebaseAwareObjectInputStream.j..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The vulnerability allowed directory traversal via crafted URLs exploiting improper URI prefix handling in StringUtils.cleanPath(). The target version 5.3.3 contains the upstream fix (commit 8ee4651038, May 2014) that rejects URI prefixes containing path separators, preventing the traversal attack. This fix was already...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. The vulnerability allowed directory traversal via crafted URLs exploiting improper URI prefix handling in StringUtils.cleanPath(). The target version 5.3.3 contains the upstream fix (commit 8ee4651038, May 2014) that rejects URI prefixes containing path separators, preventing the traversal attack. This fix was already..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:20:00.402348+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 describes predictable session ID generation in Spring Framework's Java SockJS client (versions 4.1.x before 4.1.5). The vulnerability used AlternativeJdkIdGenerator which seeded with SecureRandom once but used predictable java.util.Random thereafter. The fix (commit 52b8f344, 2015-01-22) replaced it with JdkIdGenerator using UUID.randomUUID() for cryptographically secure IDs. This...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 describes predictable session ID generation in Spring Framework's Java SockJS client (versions 4.1.x before 4.1.5). The vulnerability used AlternativeJdkIdGenerator which seeded with SecureRandom once but used predictable java.util.Random thereafter. The fix (commit 52b8f344, 2015-01-22) replaced it with JdkIdGenerator using UUID.randomUUID() for cryptographically secure IDs. This..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:13.759745+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is not present in Spring Framework 5.3.3. The upstream fix from October 2015 (commit 2bd1daa75e) was included in Spring Framework 5.3.0 and inherited by version 5.3.3. The target contains complete RFD defenses: SAFE_EXTENSIONS whitelist, automatic Content-Disposition header injection for unsafe file extensions, and path parameter sanitization to prevent exploitation via semicolon-delimited path parameters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is not present in Spring Framework 5.3.3. The upstream fix from October 2015 (commit 2bd1daa75e) was included in Spring Framework 5.3.0 and inherited by version 5.3.3. The target contains complete RFD defenses: SAFE_EXTENSIONS whitelist, automatic Content-Disposition header injection for unsafe file extensions, and path parameter sanitization to prevent exploitation via semicolon-delimited path parameters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:17:59.012677+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 describes a URL pattern matching inconsistency between Spring Security and Spring MVC that allows authorization bypass. The vulnerability occurs when Spring Security uses different pattern matching logic than Spring MVC for URL routing, causing requests to slip through authorization checks. The fix (commit a30ab30e4e, April 2016) introduced HandlerMappingIntrospector API that exposes Spring MVC's pattern matching logic to Spring Security, eliminating the mismatch. This fix was already present in the upstream Spring Framework 5.3.3 release (December 2020) when TuxCare onboarded it. Target is NOT AFFECTED - the vulnerable pattern (missing introspection API) is not present because the upstream fix shipped 4+ years before the 5.3.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 describes a URL pattern matching inconsistency between Spring Security and Spring MVC that allows authorization bypass. The vulnerability occurs when Spring Security uses different pattern matching logic than Spring MVC for URL routing, causing requests to slip through authorization checks. The fix (commit a30ab30e4e, April 2016) introduced HandlerMappingIntrospector API that exposes Spring MVC's pattern matching logic to Spring Security, eliminating the mismatch. This fix was already present in the upstream Spring Framework 5.3.3 release (December 2020) when TuxCare onboarded it. Target is NOT AFFECTED - the vulnerable pattern (missing introspection API) is not present because the upstream fix shipped 4+ years before the 5.3.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:59:38.365541+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. Spring Framework 5.3.3 is not affected by CVE-2018-11040. The vulnerability concerned automatic JSONP (JSON with Padding) enablement when MappingJackson2JsonView was configured, allowing cross-domain requests via \"jsonp\" and \"callback\" query parameters. The entire JSONP feature was completely removed from Spring Framework in upstream commit ac37b678a3 (June 2018), first released in version 5.1.0.RC1 (September 2018). The target version 5.3.3 (January 2021) inherited this removal from the upstream release. No JSONP-related code, classes, or methods exist in the codebase. The fix was authored by upstream (sdeleuze@pivotal.io), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 5.3.3 is not affected by CVE-2018-11040. The vulnerability concerned automatic JSONP (JSON with Padding) enablement when MappingJackson2JsonView was configured, allowing cross-domain requests via \"jsonp\" and \"callback\" query parameters. The entire JSONP feature was completely removed from Spring Framework in upstream commit ac37b678a3 (June 2018), first released in version 5.1.0.RC1 (September 2018). The target version 5.3.3 (January 2021) inherited this removal from the upstream release. No JSONP-related code, classes, or methods exist in the codebase. The fix was authored by upstream (sdeleuze@pivotal.io), not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:13:00.113752+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.3 is NOT affected by CVE-2018-1199. The vulnerability (path traversal via encoded characters, backslashes, and duplicate slashes in resource URLs) was fixed in upstream Spring Framework through commits addressing SPR-16616. The complete fix including processPath() normalization and isInvalidEncodedPath() validation was already present in the upstream 5.3.3 release that TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.3 is NOT affected by CVE-2018-1199. The vulnerability (path traversal via encoded characters, backslashes, and duplicate slashes in resource URLs) was fixed in upstream Spring Framework through commits addressing SPR-16616. The complete fix including processPath() normalization and isInvalidEncodedPath() validation was already present in the upstream 5.3.3 release that TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 5.3.3 is not affected by CVE-2018-1257. The vulnerability involved unconditional parsing of attacker-controlled selector headers as Spring EL expressions in STOMP over WebSocket subscriptions, enabling resource exhaustion through expensive expression evaluation (ReDoS). The fix (commit ff2228fdaf, April 2018) added the ability to disable selector header processing by setting se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.3 is not affected by CVE-2018-1257. The vulnerability involved unconditional parsing of attacker-controlled selector headers as Spring EL expressions in STOMP over WebSocket subscriptions, enabling resource exhaustion through expensive expression evaluation (ReDoS). The fix (commit ff2228fdaf, April 2018) added the ability to disable selector header processing by setting se..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 is NOT present in Spring Framework 5.3.3. The vulnerability involved improper method resolution on JDK dynamic proxy classes, which prevented security annotations from being detected and allowed authorization bypass. Both required upstream fixes (SPR-16757 and SPR-16779) were already present in the Spring Framework 5.3.3 release that TuxCare onboarded. The fixes were authored by upstream Spring maintainer Juergen Hoeller and shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is NOT present in Spring Framework 5.3.3. The vulnerability involved improper method resolution on JDK dynamic proxy classes, which prevented security annotations from being detected and allowed authorization bypass. Both required upstream fixes (SPR-16757 and SPR-16779) were already present in the Spring Framework 5.3.3 release that TuxCare onboarded. The fixes were authored by upstream Spring maintainer Juergen Hoeller and shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:02:00.150575+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 5.3.3. The directory traversal vulnerability was fixed in upstream commits from March 2018 (SPR-16616), well before the 5.3.3 release. The target repository contains the complete fix: URL-encoded path validation in PathResourceResolver and ResourceHttpRequestHandler that decodes paths and rejects those containing \"../\" or \"..\\\\\" sequences. This i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is NOT present in Spring Framework 5.3.3. The directory traversal vulnerability was fixed in upstream commits from March 2018 (SPR-16616), well before the 5.3.3 release. The target repository contains the complete fix: URL-encoded path validation in PathResourceResolver and ResourceHttpRequestHandler that decodes paths and rejects those containing \"../\" or \"..\\\\\" sequences. This i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 is NOT present in Spring Framework 5.3.3. The vulnerability involves predictable multipart boundary generation using weak java.util.Random, allowing attackers to inject malicious multipart sections when proxying requests. The target uses java.security.SecureRandom for boundary generation (MimeTypeUtils.java line 377), providing cryptographically secure randomness that prevents boundary prediction. The fix was shipped in the upstream Spring Framework release before TuxCare onboarding (commit ab2410c754 by rstoyanchev@pivotal.io, ancestor of first TuxCare commit e165d3b57b). CVE affects versions 5.0 < 5.0.5 and 4.3 < 4.3.15; version 5.3.3 is well beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in Spring Framework 5.3.3. The vulnerability involves predictable multipart boundary generation using weak java.util.Random, allowing attackers to inject malicious multipart sections when proxying requests. The target uses java.security.SecureRandom for boundary generation (MimeTypeUtils.java line 377), providing cryptographically secure randomness that prevents boundary prediction. The fix was shipped in the upstream Spring Framework release before TuxCare onboarding (commit ab2410c754 by rstoyanchev@pivotal.io, ancestor of first TuxCare commit e165d3b57b). CVE affects versions 5.0 < 5.0.5 and 4.3 < 4.3.15; version 5.3.3 is well beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:43:26.013143+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 5.3.3-tuxcare.3 is NOT AFFECTED by CVE-2018-15756. The vulnerability fix was already present in the upstream Spring Framework 5.3.3 release before TuxCare onboarded it. All three security defenses from the patch are present: MAX_RANGES=100 limit, range count validation in parseRanges(), and overlap validation in toResourceRegions(). Fix commit 423aa28ed5 by upstream author rstoyanchev@pivotal.io is an ancestor of the first TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 5.3.3-tuxcare.3 is NOT AFFECTED by CVE-2018-15756. The vulnerability fix was already present in the upstream Spring Framework 5.3.3 release before TuxCare onboarded it. All three security defenses from the patch are present: MAX_RANGES=100 limit, range count validation in parseRanges(), and overlap validation in toResourceRegions(). Fix commit 423aa28ed5 by upstream author rstoyanchev@pivotal.io is an ancestor of the first TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-12T12:28:00.064045+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.3.3-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.3-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.3.3-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.3-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:10:01.480788+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.3-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.3-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.3-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:24:16.758339+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached URI comparison code is absent. The HandlerMappingIntrospector class has no CachedResult, createCacheFilter, or setCache, so it cannot perform the affected operation (spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:72).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable cached URI comparison code is absent. The HandlerMappingIntrospector class has no CachedResult, createCacheFilter, or setCache, so it cannot perform the affected operation (spring-webmvc/src/main/java/org/springframework/web/servlet/handler/HandlerMappingIntrospector.java:72)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:56:40.126672+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 5.3.3-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 5.3.3-tuxcare.2 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@5.3.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:10:01.480788+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 5.3.3-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 5.3.3-tuxcare.2 of org.springframework:spring-core, and is fixed in 5.3.3-tuxcare.4."
    }
  ]
}