{
  "@id": "urn:uuid:a54c99f5-0069-4271-ac99-b8bebd3e4afa",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:29:28.930908+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-30T12:01:12.972757+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6, which could cause CPU exhaustion when processing regex patterns with multiple optional groups. Spring Framework 6.1.20 requires JDK 17 (confirmed in gradle/toolchains.gradle), which is 15+ years newer than the vulnerable JDK versions. The JDK 17 runtime has built-in pro...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6, which could cause CPU exhaustion when processing regex patterns with multiple optional groups. Spring Framework 6.1.20 requires JDK 17 (confirmed in gradle/toolchains.gradle), which is 15+ years newer than the vulnerable JDK versions. The JDK 17 runtime has built-in pro..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-06T17:29:28.930908+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.20 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.20 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T09:37:00.071610+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.20 is NOT affected by CVE-2011-2894. The vulnerability exploited unsafe Java deserialization in Spring's RMI remoting layer (RemoteInvocationSerializingExporter) in versions 3.0.0-3.0.5. The upstream vendor (Spring) fixed this in 2011 by adding an acceptProxyClasses flag to ConfigurableObjectInputStream that can reject proxy class deserialization. This fix (commit 7d8aa05c4...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.20 is NOT affected by CVE-2011-2894. The vulnerability exploited unsafe Java deserialization in Spring's RMI remoting layer (RemoteInvocationSerializingExporter) in versions 3.0.0-3.0.5. The upstream vendor (Spring) fixed this in 2011 by adding an acceptProxyClasses flag to ConfigurableObjectInputStream that can reject proxy class deserialization. This fix (commit 7d8aa05c4..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in the target. The fix (commit 8ee4651038) was authored by upstream Spring Framework developer Rossen Stoyanchev on 2014-05-15 and was already included in the upstream release that TuxCare onboarded (first TuxCare commit dated 2025-06-19). The fix adds a check in StringUtils.cleanPath() to prevent malformed URL prefixes containing p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 directory traversal vulnerability is NOT present in the target. The fix (commit 8ee4651038) was authored by upstream Spring Framework developer Rossen Stoyanchev on 2014-05-15 and was already included in the upstream release that TuxCare onboarded (first TuxCare commit dated 2025-06-19). The fix adds a check in StringUtils.cleanPath() to prevent malformed URL prefixes containing p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T19:05:00.096825+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (java.util.Random after initial SecureRandom seed). The vulnerability was fixed in Spring Framework 4.1.5 (January 2015) by upstream developer Rossen Stoyanchev (commit 52b8f34468), who switched the SockJS client to use JdkIdGenerator with UUI...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the Java SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (java.util.Random after initial SecureRandom seed). The vulnerability was fixed in Spring Framework 4.1.5 (January 2015) by upstream developer Rossen Stoyanchev (commit 52b8f34468), who switched the SockJS client to use JdkIdGenerator with UUI..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T12:55:53.618169+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.1.20-tuxcare.13. The fix was already included in the upstream Spring Framework release. The defense mechanism validates file extensions in URL paths and adds Content-Disposition headers to prevent malicious file downloads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "CVE-2015-5211 (Reflected File Download attack) is NOT present in Spring Framework 6.1.20-tuxcare.13. The fix was already included in the upstream Spring Framework release. The defense mechanism validates file extensions in URL paths and adds Content-Disposition headers to prevent malicious file downloads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:07:28.836714+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. The target Spring Framework 6.1.20-tuxcare.13 is NOT AFFECTED by CVE-2016-5007. The vulnerability, which allows authorization bypass through URL pattern matching inconsistencies between Spring Security and Spring MVC, was fixed in upstream commit a30ab30e4e (SPR-14321) authored by Rossen Stoyanchev. This fix was already present in the upstream Spring Framework 6.1.20 release that TuxCare onboarded, before any TuxCare modifications. The fix introduces HandlerMappingIntrospector and MatchableHandlerMapping interfaces that allow Spring Security to use the exact same pattern matching logic as Spring MVC, eliminating the pattern matching mismatch vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "The target Spring Framework 6.1.20-tuxcare.13 is NOT AFFECTED by CVE-2016-5007. The vulnerability, which allows authorization bypass through URL pattern matching inconsistencies between Spring Security and Spring MVC, was fixed in upstream commit a30ab30e4e (SPR-14321) authored by Rossen Stoyanchev. This fix was already present in the upstream Spring Framework 6.1.20 release that TuxCare onboarded, before any TuxCare modifications. The fix introduces HandlerMappingIntrospector and MatchableHandlerMapping interfaces that allow Spring Security to use the exact same pattern matching logic as Spring MVC, eliminating the pattern matching mismatch vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:50:27.486705+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. The target Spring Framework 6.1.20-tuxcare.13 is NOT affected by CVE-2018-11040. JSONP support was completely removed from the codebase in upstream commit ac37b678a3 (June 2018) by Sebastien Deleuze, eliminating all attack vectors. The removal includes: MappingJackson2JsonView (no jsonpParameterNames field), MappingJacksonValue (no JSONP methods), AbstractJsonpResponseBodyAdvice (deleted), and JSONP transport handlers (deleted). This upstream fix was already present in the 6.1.20 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "The target Spring Framework 6.1.20-tuxcare.13 is NOT affected by CVE-2018-11040. JSONP support was completely removed from the codebase in upstream commit ac37b678a3 (June 2018) by Sebastien Deleuze, eliminating all attack vectors. The removal includes: MappingJackson2JsonView (no jsonpParameterNames field), MappingJacksonValue (no JSONP methods), AbstractJsonpResponseBodyAdvice (deleted), and JSONP transport handlers (deleted). This upstream fix was already present in the 6.1.20 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T00:53:28.382036+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.20 is not affected by CVE-2018-1199. The vulnerability, which allowed bypassing security constraints using specially encoded path separators, was fixed in upstream Spring Framework commit 0e28bee0f1 (2018-03-19) by Rossen Stoyanchev. This fix was already present in the Spring Framework 6.1.20 release that TuxCare onboarded (first TuxCare commit 486cf3fca5 on 2024-11-01). Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.20 is not affected by CVE-2018-1199. The vulnerability, which allowed bypassing security constraints using specially encoded path separators, was fixed in upstream Spring Framework commit 0e28bee0f1 (2018-03-19) by Rossen Stoyanchev. This fix was already present in the Spring Framework 6.1.20 release that TuxCare onboarded (first TuxCare commit 486cf3fca5 on 2024-11-01). Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-30T08:55:17.845672+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework version 6.1.20 is not affected by CVE-2018-1257. The vulnerability was fixed by the upstream Spring Framework team in April 2018 (commit ff2228fdaf), and this fix was already present in the upstream 6.1.20 release when TuxCare onboarded it in June 2025. Additionally, a second hardening commit from June 2023 (5bc80fc094) changed the default to disable selector headers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework version 6.1.20 is not affected by CVE-2018-1257. The vulnerability was fixed by the upstream Spring Framework team in April 2018 (commit ff2228fdaf), and this fix was already present in the upstream 6.1.20 release when TuxCare onboarded it in June 2025. Additionally, a second hardening commit from June 2023 (5bc80fc094) changed the default to disable selector headers..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. Spring Framework 6.1.20 is NOT AFFECTED by CVE-2018-1258. The vulnerability (authorization bypass via incorrect proxy method resolution) was fixed in the upstream Spring Framework release in April 2018 (commit aa11721ff0 by Juergen Hoeller). This fix is present in the target version 6.1.20, which was released years after the vulnerability was discovered and patched. The vulnerable code pattern (the Proxy.isProxyClass exclusion in AopUtils.getMostSpecificMethod) has been removed, and the complementary proxy check in AnnotationMethodMatcher has been added.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Spring Framework 6.1.20 is NOT AFFECTED by CVE-2018-1258. The vulnerability (authorization bypass via incorrect proxy method resolution) was fixed in the upstream Spring Framework release in April 2018 (commit aa11721ff0 by Juergen Hoeller). This fix is present in the target version 6.1.20, which was released years after the vulnerability was discovered and patched. The vulnerable code pattern (the Proxy.isProxyClass exclusion in AopUtils.getMostSpecificMethod) has been removed, and the complementary proxy check in AnnotationMethodMatcher has been added.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-30T18:22:00.126197+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 is not present in Spring Framework 6.1.20-tuxcare.13. The vulnerability allowed directory traversal via backslash characters and encoded path sequences on Windows. The upstream fix was applied by Juergen Hoeller (jhoeller@pivotal.io) on March 21, 2018 via commit 91b803a2310344d925e5d4b1709bbcea90375548, which shipped in the upstream release that TuxCare onboarded. The fix includes...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 is not present in Spring Framework 6.1.20-tuxcare.13. The vulnerability allowed directory traversal via backslash characters and encoded path sequences on Windows. The upstream fix was applied by Juergen Hoeller (jhoeller@pivotal.io) on March 21, 2018 via commit 91b803a2310344d925e5d4b1709bbcea90375548, which shipped in the upstream release that TuxCare onboarded. The fix includes..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. Spring Framework 6.1.20 is NOT affected by CVE-2018-1272. The vulnerability (predictable multipart boundaries using weak Random) was fixed upstream in March 2018 (versions 4.3.15 and 5.0.5). Version 6.1.20, released in 2024, naturally includes this fix. The code uses SecureRandom for all multipart boundary generation via the centralized MimeTypeUtils.generateMultipartBoundary() method (line 408), making boundaries cryptographically unpredictable and preventing multipart injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.1.20 is NOT affected by CVE-2018-1272. The vulnerability (predictable multipart boundaries using weak Random) was fixed upstream in March 2018 (versions 4.3.15 and 5.0.5). Version 6.1.20, released in 2024, naturally includes this fix. The code uses SecureRandom for all multipart boundary generation via the centralized MimeTypeUtils.generateMultipartBoundary() method (line 408), making boundaries cryptographically unpredictable and preventing multipart injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-03T13:31:13.211032+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. The target Spring Framework 6.1.20 is NOT vulnerable to CVE-2018-15756. Both required defenses (MAX_RANGES=100 limit and sum-of-ranges validation) are present in the codebase at HttpRange.java lines 48-49, 137-139, and 186-196. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 423aa28ed5 and shipped in the upstream 6.1.20 release before TuxCare onboarding. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "The target Spring Framework 6.1.20 is NOT vulnerable to CVE-2018-15756. Both required defenses (MAX_RANGES=100 limit and sum-of-ranges validation) are present in the codebase at HttpRange.java lines 48-49, 137-139, and 186-196. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 423aa28ed5 and shipped in the upstream 6.1.20 release before TuxCare onboarding. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-31T20:12:17.199396+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection via newline/control characters) is not present in Spring Framework 6.1.20. The upstream fix was already included in the Spring Framework 6.1.20 release that TuxCare onboarded. The core defense mechanism (LogFormatUtils.formatValue() with regex-based newline and control character sanitization) exists and is properly applied to user-controlled input (paths, URIs, hea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection via newline/control characters) is not present in Spring Framework 6.1.20. The upstream fix was already included in the Spring Framework 6.1.20 release that TuxCare onboarded. The core defense mechanism (LogFormatUtils.formatValue() with regex-based newline and control character sanitization) exists and is properly applied to user-controlled input (paths, URIs, hea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-31T21:16:06.652991+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.20 is NOT AFFECTED by CVE-2021-22096 (log injection vulnerability). The upstream vendor (VMware/Broadcom) fixed this vulnerability in commit 99c7608f by adding sanitization of newline and control characters in LogFormatUtils.formatValue(). This fix shipped in the upstream Spring Framework 6.1.20 release before any TuxCare work on this version. The vulnerable code pattern (l...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.20 is NOT AFFECTED by CVE-2021-22096 (log injection vulnerability). The upstream vendor (VMware/Broadcom) fixed this vulnerability in commit 99c7608f by adding sanitization of newline and control characters in LogFormatUtils.formatValue(). This fix shipped in the upstream Spring Framework 6.1.20 release before any TuxCare work on this version. The vulnerable code pattern (l..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-core. CVE-2024-22233 describes two DoS vulnerabilities in Spring Framework 6.0.15 and 6.1.2: (1) malformed proxy forwarding headers causing uncaught exceptions in ForwardedHeaderFilter, and (2) URI paths with regex metacharacters causing PatternSyntaxException in HandlerMappingIntrospector. The target repository is Spring Framework 6.1.20-tuxcare.13. Both vulnerabilities were fixed in upstream Spring Framework 6.1.10 (January 2024) by commits 4afac17e58a (ForwardedHeaderFilter) and 7c9307e9706 (HandlerMappingIntrospector), authored by brian.clozel@broadcom.com. These fixes were already present in the upstream 6.1.20 release that TuxCare onboarded, as confirmed by git blame and ancestry verification. The target code contains both defenses: ForwardedHeaderFilter wraps header parsing in try-catch returning HTTP 400 (lines 158-172), and HandlerMappingIntrospector uses String.equals() instead of String.matches() for URI comparison (line 402). Verdict: not_affected (upstream fixes shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 describes two DoS vulnerabilities in Spring Framework 6.0.15 and 6.1.2: (1) malformed proxy forwarding headers causing uncaught exceptions in ForwardedHeaderFilter, and (2) URI paths with regex metacharacters causing PatternSyntaxException in HandlerMappingIntrospector. The target repository is Spring Framework 6.1.20-tuxcare.13. Both vulnerabilities were fixed in upstream Spring Framework 6.1.10 (January 2024) by commits 4afac17e58a (ForwardedHeaderFilter) and 7c9307e9706 (HandlerMappingIntrospector), authored by brian.clozel@broadcom.com. These fixes were already present in the upstream 6.1.20 release that TuxCare onboarded, as confirmed by git blame and ancestry verification. The target code contains both defenses: ForwardedHeaderFilter wraps header parsing in try-catch returning HTTP 400 (lines 158-172), and HandlerMappingIntrospector uses String.equals() instead of String.matches() for URI comparison (line 402). Verdict: not_affected (upstream fixes shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-06T09:54:00.153006+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.20-tuxcare.12"
          }
        }
      ],
      "timestamp": "2026-10-06T09:54:00.153006+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}