{
  "@id": "urn:uuid:dfee2c33-7201-40fe-9755-b55d6d24152a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:29:28.930908+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T12:02:53.198168+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 is a compound vulnerability requiring both: (1) an algorithmic complexity bug in java.util.regex.Pattern.compile that existed in JDK before 1.6, and (2) Spring Framework deserialization paths that trigger Pattern.compile with attacker-controlled regex patterns. Spring Framework 6.1.19-tuxcare.6 requires JDK 17+ (confirmed in toolchains.gradle, gradle/ide.gradle with sourceCompatib...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is a compound vulnerability requiring both: (1) an algorithmic complexity bug in java.util.regex.Pattern.compile that existed in JDK before 1.6, and (2) Spring Framework deserialization paths that trigger Pattern.compile with attacker-controlled regex patterns. Spring Framework 6.1.19-tuxcare.6 requires JDK 17+ (confirmed in toolchains.gradle, gradle/ide.gradle with sourceCompatib..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T17:29:28.930908+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T09:38:00.146680+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.19 is not affected by CVE-2011-2894. The vulnerability required RMI remoting classes (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) that were completely removed in upstream commit 5822f1bf85 (2021). Additionally, the upstream applied the proxy deserialization defense (commit 7d8aa05c40, 2011) to ConfigurableObjectInputStream, which is now the only Obj...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.19 is not affected by CVE-2011-2894. The vulnerability required RMI remoting classes (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) that were completely removed in upstream commit 5822f1bf85 (2021). Additionally, the upstream applied the proxy deserialization defense (commit 7d8aa05c40, 2011) to ConfigurableObjectInputStream, which is now the only Obj..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 6.1.19-tuxcare.7. The vulnerability was fixed in the upstream Spring Framework project in May 2014 (commit 8ee4651038 by Rossen Stoyanchev, issue SPR-11793) for versions 3.2.9+ and 4.0.5+. The fix has been carried forward through all subsequent Spring Framework releases. The target version 6.1.19 inherits this fix from upstream - the defense code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 6.1.19-tuxcare.7. The vulnerability was fixed in the upstream Spring Framework project in May 2014 (commit 8ee4651038 by Rossen Stoyanchev, issue SPR-11793) for versions 3.2.9+ and 4.0.5+. The fix has been carried forward through all subsequent Spring Framework releases. The target version 6.1.19 inherits this fix from upstream - the defense code..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:00.096825+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target version (6.1.19-tuxcare.7) contains the upstream fix from commit 52b8f344683 (Jan 2015), which replaced the predictable AlternativeJdkIdGenerator with the cryptographically secure JdkIdGenerator using UUID.randomUUID(). The fix was authored by Pivotal (rstoyan...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 due to predictable session ID generation in the Java SockJS client. The target version (6.1.19-tuxcare.7) contains the upstream fix from commit 52b8f344683 (Jan 2015), which replaced the predictable AlternativeJdkIdGenerator with the cryptographically secure JdkIdGenerator using UUID.randomUUID(). The fix was authored by Pivotal (rstoyan..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:55:53.618169+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.1.19-tuxcare.6. The vulnerability was fixed by upstream Spring developers in commit 2bd1daa75e (October 2015), which was already included in the base release before TuxCare onboarding. The fix adds Content-Disposition headers for unsafe file extensions, validates path parameters, and removes/restricts JSONP functionality. All defensive mechanisms are present and active in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.1.19-tuxcare.6. The vulnerability was fixed by upstream Spring developers in commit 2bd1daa75e (October 2015), which was already included in the base release before TuxCare onboarding. The fix adds Content-Disposition headers for unsafe file extensions, validates path parameters, and removes/restricts JSONP functionality. All defensive mechanisms are present and active in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:08:13.759745+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. CVE-2016-5007 affects Spring Framework versions 3.2.x, 4.0.x, 4.1.x, 4.2.x due to URL pattern matching discrepancies between Spring Security authorization checks and Spring MVC controller routing. The fix introduces HandlerMappingIntrospector and MatchableHandlerMapping interface to allow Spring Security to use identical pattern matching logic as Spring MVC. This fix was introduced by upstream Spring Framework in commit a30ab30e4e on 2016-04-25 by Rossen Stoyanchev (rstoyanchev@pivotal.io). The target version 6.1.19-tuxcare.6 already contains this fix, as it was shipped in the upstream release before TuxCare onboarded this version on 2026-08-09. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 affects Spring Framework versions 3.2.x, 4.0.x, 4.1.x, 4.2.x due to URL pattern matching discrepancies between Spring Security authorization checks and Spring MVC controller routing. The fix introduces HandlerMappingIntrospector and MatchableHandlerMapping interface to allow Spring Security to use identical pattern matching logic as Spring MVC. This fix was introduced by upstream Spring Framework in commit a30ab30e4e on 2016-04-25 by Rossen Stoyanchev (rstoyanchev@pivotal.io). The target version 6.1.19-tuxcare.6 already contains this fix, as it was shipped in the upstream release before TuxCare onboarded this version on 2026-08-09. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:50:27.486705+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. Spring Framework 6.1.19 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed from the upstream Spring Framework codebase in commit ac37b678a3 (June 7, 2018), which predates TuxCare's involvement with this version. The target contains no JSONP-related code - no jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, and no JSONP parameter processing methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.1.19 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed from the upstream Spring Framework codebase in commit ac37b678a3 (June 7, 2018), which predates TuxCare's involvement with this version. The target contains no JSONP-related code - no jsonpParameterNames field, no AbstractJsonpResponseBodyAdvice class, and no JSONP parameter processing methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T00:53:00.082543+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 6.1.19-tuxcare.7. The vulnerability involved bypassing security constraints via URL path parameters with special encodings (encoded dots, duplicate slashes, backslashes). The upstream Spring Framework team fixed this in commits 0e28bee0f1 and 91b803a231 by adding path normalization (processPath/normalizeInputPath/cleanDuplicateSlashes) and encode...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 6.1.19-tuxcare.7. The vulnerability involved bypassing security constraints via URL path parameters with special encodings (encoded dots, duplicate slashes, backslashes). The upstream Spring Framework team fixed this in commits 0e28bee0f1 and 91b803a231 by adding path normalization (processPath/normalizeInputPath/cleanDuplicateSlashes) and encode..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T09:01:17.494754+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 affects Spring Framework's STOMP over WebSocket with selector header support, where malicious Spring EL expressions could cause regex DoS. The target (6.1.19) contains the upstream fix from April 2018 (commit ff2228fdaf by rstoyanchev@pivotal.io) that added the ability to disable selector header processing by setting selectorHeaderName to null. Additionally, Spring Framework 6.1+ ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework's STOMP over WebSocket with selector header support, where malicious Spring EL expressions could cause regex DoS. The target (6.1.19) contains the upstream fix from April 2018 (commit ff2228fdaf by rstoyanchev@pivotal.io) that added the ability to disable selector header processing by setting selectorHeaderName to null. Additionally, Spring Framework 6.1+ ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 with an authorization bypass when using method security with JDK dynamic proxies. The vulnerability was caused by incorrect method resolution in AopUtils.getMostSpecificMethod, which excluded proxy classes from target method resolution. This caused method-level security annotations to be evaluated against proxy interface methods instead of implementation methods, allowing unauthorized access. The upstream fix (commit aa11721ff0) was applied by Spring Framework on April 27, 2018, removing the Proxy.isProxyClass exclusion check. This fix was already present in the upstream release 6.1.19 that TuxCare onboarded on August 13, 2026. Target version 6.1.19-tuxcare.7 is NOT vulnerable - the fix shipped with the upstream release before TuxCare adoption.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 with an authorization bypass when using method security with JDK dynamic proxies. The vulnerability was caused by incorrect method resolution in AopUtils.getMostSpecificMethod, which excluded proxy classes from target method resolution. This caused method-level security annotations to be evaluated against proxy interface methods instead of implementation methods, allowing unauthorized access. The upstream fix (commit aa11721ff0) was applied by Spring Framework on April 27, 2018, removing the Proxy.isProxyClass exclusion check. This fix was already present in the upstream release 6.1.19 that TuxCare onboarded on August 13, 2026. Target version 6.1.19-tuxcare.7 is NOT vulnerable - the fix shipped with the upstream release before TuxCare adoption.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T18:25:30.188696+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.19 is not affected by CVE-2018-1271. The vulnerability involved Windows directory traversal via URL-encoded backslashes (..\\) when serving static resources. The upstream fix (commit 91b803a2310344d925e5d4b1709bbcea90375548 by Juergen Hoeller, March 2018) added validation to reject both ../ and ..\\ patterns in decoded paths, and shipped in Spring Framework 5.0.5/4.3.15. Vers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.19 is not affected by CVE-2018-1271. The vulnerability involved Windows directory traversal via URL-encoded backslashes (..\\) when serving static resources. The upstream fix (commit 91b803a2310344d925e5d4b1709bbcea90375548 by Juergen Hoeller, March 2018) added validation to reject both ../ and ..\\ patterns in decoded paths, and shipped in Spring Framework 5.0.5/4.3.15. Vers..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. CVE-2018-1272 is NOT present in Spring Framework 6.1.19-tuxcare.6. The vulnerability involved using weak `Random` instead of `SecureRandom` for generating multipart boundary strings, allowing attackers to predict boundaries and inject malicious multipart content. The fix (commit 847202c8f8e by upstream author jhoeller@pivotal.io on 2018-06-25) was already present in the upstream release before TuxCare onboarded version 6.1.19. The current code uses `SecureRandom()` at MimeTypeUtils.java:408, making boundaries cryptographically unpredictable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 is NOT present in Spring Framework 6.1.19-tuxcare.6. The vulnerability involved using weak `Random` instead of `SecureRandom` for generating multipart boundary strings, allowing attackers to predict boundaries and inject malicious multipart content. The fix (commit 847202c8f8e by upstream author jhoeller@pivotal.io on 2018-06-25) was already present in the upstream release before TuxCare onboarded version 6.1.19. The current code uses `SecureRandom()` at MimeTypeUtils.java:408, making boundaries cryptographically unpredictable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T13:32:06.363098+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. Spring Framework 6.1.19 is not affected by CVE-2018-15756. The vulnerability was fixed in the upstream release prior to TuxCare onboarding. The target contains both required defenses: (1) range count validation limiting requests to 100 ranges maximum (HttpRange.java:137-139), and (2) sum-of-ranges validation ensuring total range coverage is less than resource length (HttpRange.java:186-196). The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 423aa28ed5 and shipped in all Spring Framework releases after October 2018, including the upstream 6.1.19 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.1.19 is not affected by CVE-2018-15756. The vulnerability was fixed in the upstream release prior to TuxCare onboarding. The target contains both required defenses: (1) range count validation limiting requests to 100 ranges maximum (HttpRange.java:137-139), and (2) sum-of-ranges validation ensuring total range coverage is less than resource length (HttpRange.java:186-196). The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 423aa28ed5 and shipped in all Spring Framework releases after October 2018, including the upstream 6.1.19 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T14:17:46.916788+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. Version 6.1.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-6gf2-pvqw-37ph (affected below 5.3.14), NVD (affected up to 5.3.13), CVE record (affected up to 5.3.13), Snyk (affected below 5.3.14).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "Version 6.1.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-6gf2-pvqw-37ph (affected below 5.3.14), NVD (affected up to 5.3.13), CVE record (affected up to 5.3.13), Snyk (affected below 5.3.14)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-31T21:16:51.996676+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.19 is NOT affected by CVE-2021-22096 (log injection). The upstream fix for this vulnerability was already present in the Spring Framework 6.1.19 release that TuxCare onboarded. The fix consists of LogFormatUtils.formatValue() sanitization (replacing newlines with &lt;EOL&gt; and control characters with ?) applied to all user-controlled input before logging. Both key fix com...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.19 is NOT affected by CVE-2021-22096 (log injection). The upstream fix for this vulnerability was already present in the Spring Framework 6.1.19 release that TuxCare onboarded. The fix consists of LogFormatUtils.formatValue() sanitization (replacing newlines with &lt;EOL&gt; and control characters with ?) applied to all user-controlled input before logging. Both key fix com..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-core. The target Spring Framework 6.1.19 is NOT AFFECTED by CVE-2024-22233. Both vulnerability patterns (unhandled exceptions from malformed forwarded headers and regex metacharacters in URIs) were fixed by upstream Spring Framework in version 6.1.3. The target version 6.1.19 was onboarded by TuxCare with these fixes already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "The target Spring Framework 6.1.19 is NOT AFFECTED by CVE-2024-22233. Both vulnerability patterns (unhandled exceptions from malformed forwarded headers and regex metacharacters in URIs) were fixed by upstream Spring Framework in version 6.1.3. The target version 6.1.19 was onboarded by TuxCare with these fixes already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.19-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}