{
  "@id": "urn:uuid:1186a798-da4b-4991-85f1-b0cfd2dcaeaf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 53,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:30:26.757723+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:09:48.333130+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6. Spring Framework 6.1.14 requires Java 17+ (documented in framework-docs/modules/ROOT/pages/overview.adoc), which has long since fixed the underlying JDK bug. The vulnerable runtime environment (JDK < 1.6) is not and c...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6. Spring Framework 6.1.14 requires Java 17+ (documented in framework-docs/modules/ROOT/pages/overview.adoc), which has long since fixed the underlying JDK bug. The vulnerable runtime environment (JDK < 1.6) is not and c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:30:26.757723+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:39:27.877533+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.14 is NOT affected by CVE-2011-2894. The vulnerability's attack surface (RMI remoting services that deserialize untrusted proxy classes) was completely removed in Spring Framework 6.0 (commit 5822f1bf85, Sept 2021). The classes mentioned in the CVE patches\u2014RemoteInvocationSerializingExporter and CodebaseAwareObjectInputStream\u2014no longer exist. While ConfigurableObjectInputSt...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.14 is NOT affected by CVE-2011-2894. The vulnerability's attack surface (RMI remoting services that deserialize untrusted proxy classes) was completely removed in Spring Framework 6.0 (commit 5822f1bf85, Sept 2021). The classes mentioned in the CVE patches\u2014RemoteInvocationSerializingExporter and CodebaseAwareObjectInputStream\u2014no longer exist. While ConfigurableObjectInputSt..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.1.14. The fix was introduced by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev on 2014-05-15) and was already part of the upstream 6.1.14 release that TuxCare onboarded. The vulnerable code pattern (unconditional prefix extraction before path normalization) has been repl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.1.14. The fix was introduced by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev on 2014-05-15) and was already part of the upstream 6.1.14 release that TuxCare onboarded. The vulnerable code pattern (unconditional prefix extraction before path normalization) has been repl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:00.096825+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses weak java.util.Random after initial seeding). The fix was introduced in Spring Framework 4.2.0 (commit 52b8f34468, February 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator that uses cryptographically secure UUID.ra...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which uses weak java.util.Random after initial seeding). The fix was introduced in Spring Framework 4.2.0 (commit 52b8f34468, February 2015) by replacing AlternativeJdkIdGenerator with JdkIdGenerator that uses cryptographically secure UUID.ra..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download vulnerability) is NOT present in Spring Framework 6.1.14. The fix was applied by upstream Spring developers in October 2015 (commit 2bd1daa7) and shipped in the upstream 6.1.14 release that TuxCare onboarded. The RFD protection mechanisms are present: Content-Disposition header injection for unsafe file extensions, path parameter validation, and safe extension whitelisting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download vulnerability) is NOT present in Spring Framework 6.1.14. The fix was applied by upstream Spring developers in October 2015 (commit 2bd1daa7) and shipped in the upstream 6.1.14 release that TuxCare onboarded. The RFD protection mechanisms are present: Content-Disposition header injection for unsafe file extensions, path parameter validation, and safe extension whitelisting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:56.260651+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 is NOT present in Spring Framework 6.1.14-tuxcare.3. The vulnerability, which allowed authorization bypass through pattern matching inconsistencies between Spring Security and Spring MVC, was fixed in upstream Spring Framework 4.3.1 (June 2016) via commit a30ab30e4e. This fix introduced the HandlerMappingIntrospector API and MatchableHandlerMapping interface to ensure consistent pattern matching. The target version 6.1.14 already contains this fix as it shipped in the upstream release that TuxCare onboarded. The fix author (rstoyanchev@pivotal.io) is an upstream Spring developer, not a TuxCare/CloudLinux engineer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 is NOT present in Spring Framework 6.1.14-tuxcare.3. The vulnerability, which allowed authorization bypass through pattern matching inconsistencies between Spring Security and Spring MVC, was fixed in upstream Spring Framework 4.3.1 (June 2016) via commit a30ab30e4e. This fix introduced the HandlerMappingIntrospector API and MatchableHandlerMapping interface to ensure consistent pattern matching. The target version 6.1.14 already contains this fix as it shipped in the upstream release that TuxCare onboarded. The fix author (rstoyanchev@pivotal.io) is an upstream Spring developer, not a TuxCare/CloudLinux engineer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:51:14.737145+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.1.14 is not affected by CVE-2018-11040. JSONP support was completely removed in Spring Framework 5.1 (commit ac37b678a3) by upstream developer Sebastien Deleuze, well before version 6.1.14 was released. The vulnerable code pattern (automatic JSONP enablement via default \"jsonp\" and \"callback\" query parameter names in MappingJackson2JsonView) does not exist in the target version. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.1.14 is not affected by CVE-2018-11040. JSONP support was completely removed in Spring Framework 5.1 (commit ac37b678a3) by upstream developer Sebastien Deleuze, well before version 6.1.14 was released. The vulnerable code pattern (automatic JSONP enablement via default \"jsonp\" and \"callback\" query parameter names in MappingJackson2JsonView) does not exist in the target version. This is an upstream fix that shipped in the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T00:55:00.856051+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.14-tuxcare.3 is NOT affected by CVE-2018-1199. The vulnerability fixes (path normalization, duplicate slash removal, and encoded path traversal validation) were already included in the upstream Spring Framework 6.1.14 release that TuxCare onboarded. The security patches authored by Spring Framework developers (rstoyanchev@pivotal.io, jhoeller@pivotal.io) in March 2018 are p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.14-tuxcare.3 is NOT affected by CVE-2018-1199. The vulnerability fixes (path normalization, duplicate slash removal, and encoded path traversal validation) were already included in the upstream Spring Framework 6.1.14 release that TuxCare onboarded. The security patches authored by Spring Framework developers (rstoyanchev@pivotal.io, jhoeller@pivotal.io) in March 2018 are p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T09:01:17.494754+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Target Spring Framework 6.1.14 is NOT affected by CVE-2018-1257. The vulnerability pattern (enabled-by-default selector header processing accepting untrusted SpEL expressions) is not present. An upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) disabled the SpEL selector feature by default in Spring Framework 6.1+. This fix was already included in the upstream 6.1.14 release tha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Target Spring Framework 6.1.14 is NOT affected by CVE-2018-1257. The vulnerability pattern (enabled-by-default selector header processing accepting untrusted SpEL expressions) is not present. An upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) disabled the SpEL selector feature by default in Spring Framework 6.1+. This fix was already included in the upstream 6.1.14 release tha..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 where incorrect method resolution on dynamic proxy classes causes authorization annotations to be missed, allowing unauthorized access to secured methods. The target repository (Spring Framework 6.1.14-tuxcare.3) is NOT AFFECTED because the vulnerability was fixed in upstream Spring Framework in April 2018 (commits 8b051ab06e and f2e77c292d by Juergen Hoeller). The fix was already present in the upstream 6.1.14 release that TuxCare onboarded via commit 0382968da8. All defense components are verified present: AopUtils.getMostSpecificMethod properly handles proxy classes, AnnotationMethodMatcher has early proxy return, and both CacheAspectSupport and ApplicationListenerMethodAdapter correctly resolve target methods for annotation checking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 where incorrect method resolution on dynamic proxy classes causes authorization annotations to be missed, allowing unauthorized access to secured methods. The target repository (Spring Framework 6.1.14-tuxcare.3) is NOT AFFECTED because the vulnerability was fixed in upstream Spring Framework in April 2018 (commits 8b051ab06e and f2e77c292d by Juergen Hoeller). The fix was already present in the upstream 6.1.14 release that TuxCare onboarded via commit 0382968da8. All defense components are verified present: AopUtils.getMostSpecificMethod properly handles proxy classes, AnnotationMethodMatcher has early proxy return, and both CacheAspectSupport and ApplicationListenerMethodAdapter correctly resolve target methods for annotation checking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:28:50.149316+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15 via directory traversal using URL-encoded path sequences on Windows. The target version 6.1.14 contains the complete upstream fix introduced in March 2018 (commits 0e28bee0f1, 91b803a231, and subsequent refinements). All four key files (ResourceHttpRequestHandler, PathResourceResolver in both webmvc and webflux mo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15 via directory traversal using URL-encoded path sequences on Windows. The target version 6.1.14 contains the complete upstream fix introduced in March 2018 (commits 0e28bee0f1, 91b803a231, and subsequent refinements). All four key files (ResourceHttpRequestHandler, PathResourceResolver in both webmvc and webflux mo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.1.14 is not affected by CVE-2018-1272. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The fix (using SecureRandom instead of Random for multipart boundary generation) was introduced in upstream commit ab2410c754b67902f002bfcc0c3895bd7772d39f by Rossen Stoyanchev (rstoyanchev@pivotal.io) and was already present in the upstream Spring Framework 6.1.14 release when TuxCare onboarded it. The target code uses SecureRandom for generating unpredictable multipart boundaries, preventing the injection attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.1.14 is not affected by CVE-2018-1272. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The fix (using SecureRandom instead of Random for multipart boundary generation) was introduced in upstream commit ab2410c754b67902f002bfcc0c3895bd7772d39f by Rossen Stoyanchev (rstoyanchev@pivotal.io) and was already present in the upstream Spring Framework 6.1.14 release when TuxCare onboarded it. The target code uses SecureRandom for generating unpredictable multipart boundaries, preventing the injection attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:59.098532+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 6.1.14 is NOT vulnerable to CVE-2018-15756. The upstream fix for this DoS vulnerability was already included in the Spring Framework 6.1.14 release. The fix (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e by rstoyanchev@pivotal.io, 2018-10-03) limits HTTP Range requests to 100 ranges and validates that the sum of all ranges doesn't exceed the resource length. Both defensive mechanisms are present in HttpRange.java at HEAD. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 6.1.14 is NOT vulnerable to CVE-2018-15756. The upstream fix for this DoS vulnerability was already included in the Spring Framework 6.1.14 release. The fix (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e by rstoyanchev@pivotal.io, 2018-10-03) limits HTTP Range requests to 100 ranges and validates that the sum of all ranges doesn't exceed the resource length. Both defensive mechanisms are present in HttpRange.java at HEAD. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:19:00.105438+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2021-22060 (log injection via newline/control characters). The vulnerability pattern is not present because the upstream fix was already included in version 6.1.14 when TuxCare onboarded it. The fix includes: (1) LogFormatUtils.formatValue() sanitizing newlines and control characters, and (2) application of this sanitization in 30+ locations where ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2021-22060 (log injection via newline/control characters). The vulnerability pattern is not present because the upstream fix was already included in version 6.1.14 when TuxCare onboarded it. The fix includes: (1) LogFormatUtils.formatValue() sanitizing newlines and control characters, and (2) application of this sanitization in 30+ locations where ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:18:26.996099+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22096 (log injection) is NOT present in Spring Framework 6.1.14-tuxcare.3. The upstream Spring Framework project fixed this vulnerability before releasing version 6.1.14, which TuxCare then onboarded. The fix includes LogFormatUtils.formatValue() that sanitizes user-controlled input by replacing newline characters with <EOL> and control characters with '?' before logging. This defense ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 (log injection) is NOT present in Spring Framework 6.1.14-tuxcare.3. The upstream Spring Framework project fixed this vulnerability before releasing version 6.1.14, which TuxCare then onboarded. The fix includes LogFormatUtils.formatValue() that sanitizes user-controlled input by replacing newline characters with <EOL> and control characters with '?' before logging. This defense ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-core. The target Spring Framework 6.1.14-tuxcare.3 is NOT affected by CVE-2024-22233. Both vulnerability fixes were applied by upstream Spring Framework (author: Brian Clozel, Broadcom) and shipped in the upstream 6.1.14 release before TuxCare onboarded it. The vulnerable code patterns are not present: (1) ForwardedHeaderFilter has exception handling that catches malformed forwarded header parsing errors and returns HTTP 400, and (2) HandlerMappingIntrospector uses String.equals() instead of String.matches() to prevent PatternSyntaxException on URIs with regex metacharacters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "The target Spring Framework 6.1.14-tuxcare.3 is NOT affected by CVE-2024-22233. Both vulnerability fixes were applied by upstream Spring Framework (author: Brian Clozel, Broadcom) and shipped in the upstream 6.1.14 release before TuxCare onboarded it. The vulnerable code patterns are not present: (1) ForwardedHeaderFilter has exception handling that catches malformed forwarded header parsing errors and returns HTTP 400, and (2) HandlerMappingIntrospector uses String.equals() instead of String.matches() to prevent PatternSyntaxException on URIs with regex metacharacters.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.1.14-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:38:26.065594+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.1.14-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.1.14-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.1.14-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.1.14-tuxcare.3."
    }
  ]
}