{
  "@id": "urn:uuid:498c66cb-fac4-47b4-b884-24056bf5eeb2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:29:28.930908+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:01:12.972757+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2009-1190. While the code still contains serializable classes (AbstractRegexpMethodPointcut, JdkRegexpMethodPointcut) that deserialize and compile regex patterns without validation, the underlying vulnerability is a specific algorithmic complexity bug in java.util.regex.Pattern.compile that existed only in JDK versions before 1.6. Spring Framework ...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2009-1190. While the code still contains serializable classes (AbstractRegexpMethodPointcut, JdkRegexpMethodPointcut) that deserialize and compile regex patterns without validation, the underlying vulnerability is a specific algorithmic complexity bug in java.util.regex.Pattern.compile that existed only in JDK versions before 1.6. Spring Framework ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:29:28.930908+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:36:36.227311+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.16 contains the upstream fix for CVE-2011-2894. The fix (commit 7d8aa05c) was authored by Juergen Hoeller from VMware and shipped in the upstream release before TuxCare onboarded it. The fix adds an acceptProxyClasses flag to ConfigurableObjectInputStream that blocks proxy class deserialization. The vulnerable RMI remoting classes (CodebaseAwareObjectInputStream, RemoteInvo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.16 contains the upstream fix for CVE-2011-2894. The fix (commit 7d8aa05c) was authored by Juergen Hoeller from VMware and shipped in the upstream release before TuxCare onboarded it. The fix adds an acceptProxyClasses flag to ConfigurableObjectInputStream that blocks proxy class deserialization. The vulnerable RMI remoting classes (CodebaseAwareObjectInputStream, RemoteInvo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.1.16-tuxcare.7. The fix was shipped in upstream release v4.1.0.RC1 (May 2014), long before this version. The vulnerable pattern (missing prefix validation in StringUtils.cleanPath) does not exist in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in Spring Framework 6.1.16-tuxcare.7. The fix was shipped in upstream release v4.1.0.RC1 (May 2014), long before this version. The vulnerable pattern (missing prefix validation in StringUtils.cleanPath) does not exist in the target code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:46.375124+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 describes predictable session IDs in Spring Framework 4.1.x before 4.1.5 Java SockJS client. The vulnerability was fixed in upstream commit 52b8f34468 (January 2015) by replacing AlternativeJdkIdGenerator (which used non-secure Random after initial seed) with JdkIdGenerator (which uses UUID.randomUUID() with SecureRandom). Target version 6.1.16 contains this upstream fix - confirm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 describes predictable session IDs in Spring Framework 4.1.x before 4.1.5 Java SockJS client. The vulnerability was fixed in upstream commit 52b8f34468 (January 2015) by replacing AlternativeJdkIdGenerator (which used non-secure Random after initial seed) with JdkIdGenerator (which uses UUID.randomUUID() with SecureRandom). Target version 6.1.16 contains this upstream fix - confirm..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:55:53.618169+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.1.16. The vulnerability allows attackers to craft URLs with malicious file extensions (e.g., .bat, .cmd) that cause responses to be downloaded and executed. The upstream fix was introduced in commit 2bd1daa75e by Rossen Stoyanchev (rstoyanchev@pivotal.io) in Spring Framework v4.2.2.RELEASE (October 2015), which added Content-Disposition header protection and extension whitelisting. This fix has been present in the codebase for over 10 years and was already included in the upstream v6.1.16 release before TuxCare onboarding. The defense code is fully present in AbstractMessageConverterMethodProcessor.java with SAFE_EXTENSIONS whitelist and addContentDispositionHeader method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.1.16. The vulnerability allows attackers to craft URLs with malicious file extensions (e.g., .bat, .cmd) that cause responses to be downloaded and executed. The upstream fix was introduced in commit 2bd1daa75e by Rossen Stoyanchev (rstoyanchev@pivotal.io) in Spring Framework v4.2.2.RELEASE (October 2015), which added Content-Disposition header protection and extension whitelisting. This fix has been present in the codebase for over 10 years and was already included in the upstream v6.1.16 release before TuxCare onboarding. The defense code is fully present in AbstractMessageConverterMethodProcessor.java with SAFE_EXTENSIONS whitelist and addContentDispositionHeader method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:07:28.836714+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.16 is not affected by CVE-2016-5007. The vulnerability involved pattern matching discrepancies between Spring Security (authorization) and Spring Framework (controller routing) that could lead to authorization bypass. The upstream fix introduced HandlerMappingIntrospector API and MatchableHandlerMapping interface (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by rstoyanchev@pivotal.io, @since 4.3.1) to expose Spring MVC's pattern matching logic to Spring Security. This fix was already present in the upstream release before TuxCare's first commit (73712e8616c). The target version contains the full defensive API: MatchableHandlerMapping interface with match() method, HandlerMappingIntrospector class, RequestMatchResult class, and implementations in both AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The vulnerable pattern (absence of introspection API) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 6.1.16 is not affected by CVE-2016-5007. The vulnerability involved pattern matching discrepancies between Spring Security (authorization) and Spring Framework (controller routing) that could lead to authorization bypass. The upstream fix introduced HandlerMappingIntrospector API and MatchableHandlerMapping interface (commit a30ab30e4e9ae021fdda04e9abfc228476b846b5 by rstoyanchev@pivotal.io, @since 4.3.1) to expose Spring MVC's pattern matching logic to Spring Security. This fix was already present in the upstream release before TuxCare's first commit (73712e8616c). The target version contains the full defensive API: MatchableHandlerMapping interface with match() method, HandlerMappingIntrospector class, RequestMatchResult class, and implementations in both AbstractUrlHandlerMapping and RequestMappingHandlerMapping. The vulnerable pattern (absence of introspection API) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:50:27.486705+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.16-tuxcare.7 is not affected by CVE-2018-11040 (JSONP cross-domain request vulnerability). JSONP support was completely removed from Spring Framework by upstream commit ac37b678a3 on 2018-06-07, which predates TuxCare's involvement with version 6.1.16. The vulnerable code (MappingJackson2JsonView's jsonpParameterNames field, AbstractJsonpResponseBodyAdvice, JsonpPollingTransportHandler) no longer exists in the target. The attack chain from HTTP requests with jsonp/callback parameters to cross-domain data access via JavaScript callback wrapping cannot occur because the JSONP processing code has been deleted entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.1.16-tuxcare.7 is not affected by CVE-2018-11040 (JSONP cross-domain request vulnerability). JSONP support was completely removed from Spring Framework by upstream commit ac37b678a3 on 2018-06-07, which predates TuxCare's involvement with version 6.1.16. The vulnerable code (MappingJackson2JsonView's jsonpParameterNames field, AbstractJsonpResponseBodyAdvice, JsonpPollingTransportHandler) no longer exists in the target. The attack chain from HTTP requests with jsonp/callback parameters to cross-domain data access via JavaScript callback wrapping cannot occur because the JSONP processing code has been deleted entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T00:56:22.909862+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Target version 6.1.16 is not affected by CVE-2018-1199. The vulnerability allows attackers to use semicolon-delimited URL path parameters (e.g., /secured/resource.js;param=value) with special encodings to bypass security constraints on Spring MVC static resources. The defense (removing semicolon content from request URIs before security matching) is present and active by default in the target v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Target version 6.1.16 is not affected by CVE-2018-1199. The vulnerability allows attackers to use semicolon-delimited URL path parameters (e.g., /secured/resource.js;param=value) with special encodings to bypass security constraints on Spring MVC static resources. The defense (removing semicolon content from request URIs before security matching) is present and active by default in the target v..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T09:01:17.494754+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 describes a DoS vulnerability via malicious Spring EL expressions in STOMP subscription selector headers. The target Spring Framework 6.1.16 has an upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) that disables the SpEL selector feature by default. The selectorHeaderName field defaults to null, and the getSelectorExpression() method checks for null before attempti...",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 describes a DoS vulnerability via malicious Spring EL expressions in STOMP subscription selector headers. The target Spring Framework 6.1.16 has an upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) that disables the SpEL selector feature by default. The selectorHeaderName field defaults to null, and the getSelectorExpression() method checks for null before attempti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.16-tuxcare.7 is NOT affected by CVE-2018-1258. The authorization bypass vulnerability was fixed by upstream Spring in April 2018 (commits 8b051ab06e and f2e77c292d) for version 5.0.5. All fixes were already present in the upstream Spring Framework 6.1.16 release that TuxCare onboarded. Verified: (1) AnnotationMethodMatcher has proxy class check preventing annotation matching on proxy methods, (2) CacheAspectSupport and ApplicationListenerMethodAdapter both use proxy-aware target method resolution, (3) AopUtils.getMostSpecificMethod correctly handles proxy classes. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 6.1.16-tuxcare.7 is NOT affected by CVE-2018-1258. The authorization bypass vulnerability was fixed by upstream Spring in April 2018 (commits 8b051ab06e and f2e77c292d) for version 5.0.5. All fixes were already present in the upstream Spring Framework 6.1.16 release that TuxCare onboarded. Verified: (1) AnnotationMethodMatcher has proxy class check preventing annotation matching on proxy methods, (2) CacheAspectSupport and ApplicationListenerMethodAdapter both use proxy-aware target method resolution, (3) AopUtils.getMostSpecificMethod correctly handles proxy classes. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T18:24:00.134648+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2018-1271. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The fix was applied upstream by Spring Framework in March 2018 (commit f59ea610dfc) and is present in the upstream 6.1.16 release from December 2024. Both PathResourceResolver implementations (webmvc and webflux) include the Windows backslash check that preve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2018-1271. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.15. The fix was applied upstream by Spring Framework in March 2018 (commit f59ea610dfc) and is present in the upstream 6.1.16 release from December 2024. Both PathResourceResolver implementations (webmvc and webflux) include the Windows backslash check that preve..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. Spring Framework 6.1.16 is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak Random(), allowing attackers to inject additional multipart parts. The target already contains the upstream fix (commit ab2410c754, 2018-03-23) that replaced Random with SecureRandom. This fix was shipped in the upstream release before TuxCare onboarded version 6.1.16, as confirmed by the fix being an ancestor of the first TuxCare commit (73712e8616).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.1.16 is not affected by CVE-2018-1272. The vulnerability involved predictable multipart boundary generation using weak Random(), allowing attackers to inject additional multipart parts. The target already contains the upstream fix (commit ab2410c754, 2018-03-23) that replaced Random with SecureRandom. This fix was shipped in the upstream release before TuxCare onboarded version 6.1.16, as confirmed by the fix being an ancestor of the first TuxCare commit (73712e8616).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:06.363098+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. CVE-2018-15756 (HTTP Range DoS vulnerability) is NOT present in Spring Framework 6.1.16-tuxcare.7. The target code contains both required defenses from the upstream vendor patch: (1) MAX_RANGES=100 limit preventing excessive range count, and (2) validation that the sum of all range sizes is less than the resource length to prevent overlapping ranges. The fix was introduced in upstream commit 423aa28ed5 (Oct 2018) by Rossen Stoyanchev (rstoyanchev@pivotal.io), shipped in the upstream 6.1.16 release before TuxCare onboarding. The vulnerable pattern (unbounded range count and unchecked range overlap) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 (HTTP Range DoS vulnerability) is NOT present in Spring Framework 6.1.16-tuxcare.7. The target code contains both required defenses from the upstream vendor patch: (1) MAX_RANGES=100 limit preventing excessive range count, and (2) validation that the sum of all range sizes is less than the resource length to prevent overlapping ranges. The fix was introduced in upstream commit 423aa28ed5 (Oct 2018) by Rossen Stoyanchev (rstoyanchev@pivotal.io), shipped in the upstream 6.1.16 release before TuxCare onboarding. The vulnerable pattern (unbounded range count and unchecked range overlap) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T20:16:05.248593+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 The target (Spring Framework 6.1.16-tuxcare.7) is NOT affected by CVE-2021-22060 (log injection vulnerability). The fix was already present in the upstream Spring Framework 6.1.16 release. The vulnerability allowed attackers to inject additional log entries by providing malicious input containing newline or control characters. The defense (LogFormatUtils.formatValue() sanitizing user input befo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Framework 6.1.16-tuxcare.7) is NOT affected by CVE-2021-22060 (log injection vulnerability). The fix was already present in the upstream Spring Framework 6.1.16 release. The vulnerability allowed attackers to inject additional log entries by providing malicious input containing newline or control characters. The defense (LogFormatUtils.formatValue() sanitizing user input befo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T21:16:51.996676+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. not_affected \u2014 Target Spring Framework 6.1.16-tuxcare.7 is NOT AFFECTED by CVE-2021-22096 (log injection via unsanitized user input). The vulnerability pattern is not present because the upstream fix was already included in the Spring Framework 6.1.16 release that TuxCare onboarded. The fix (commit 99c7608ffe7 by Rossen Stoyanchev from VMware, Dec 2021) adds LogFormatUtils patterns to replace newlines with &l...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Target Spring Framework 6.1.16-tuxcare.7 is NOT AFFECTED by CVE-2021-22096 (log injection via unsanitized user input). The vulnerability pattern is not present because the upstream fix was already included in the Spring Framework 6.1.16 release that TuxCare onboarded. The fix (commit 99c7608ffe7 by Rossen Stoyanchev from VMware, Dec 2021) adds LogFormatUtils patterns to replace newlines with &l..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.1.16-tuxcare.1 of org.springframework:spring-core. The target Spring Framework 6.1.16-tuxcare.7 is NOT AFFECTED by CVE-2024-22233. Both vulnerability fixes were already present in the upstream Spring Framework 6.1.16 release before TuxCare onboarded it. The fixes address two DoS vectors: (1) uncaught exceptions from malformed forwarded headers, and (2) PatternSyntaxException from URIs with regex special characters. The ForwardedHeaderFilter now catches all exceptions during header processing and returns HTTP 400 (lines 166-171), and HandlerMappingIntrospector uses String.equals() instead of String.matches() for URI comparison (line 402). Both fixes were authored by Brian Clozel from Broadcom (upstream) and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "The target Spring Framework 6.1.16-tuxcare.7 is NOT AFFECTED by CVE-2024-22233. Both vulnerability fixes were already present in the upstream Spring Framework 6.1.16 release before TuxCare onboarded it. The fixes address two DoS vectors: (1) uncaught exceptions from malformed forwarded headers, and (2) PatternSyntaxException from URIs with regex special characters. The ForwardedHeaderFilter now catches all exceptions during header processing and returns HTTP 400 (lines 166-171), and HandlerMappingIntrospector uses String.equals() instead of String.matches() for URI comparison (line 402). Both fixes were authored by Brian Clozel from Broadcom (upstream) and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 6.1.16-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.16-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 6.1.16-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.16-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.1.16-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.16-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.1.16-tuxcare.1 of org.springframework:spring-core, and is fixed in 6.1.16-tuxcare.2."
    }
  ]
}