{
  "@id": "urn:uuid:6443c501-57a3-44ea-aa4f-7bdf3629b4aa",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 53,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:31:17.527478+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T12:15:12.464408+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity DoS vulnerability in Spring Framework's deserialization of regex patterns. The vulnerability existed when JdkRegexpMethodPointcut stored Pattern[] fields as transient and recompiled them from untrusted strings during deserialization via a custom readObject() method. This allowed attackers to trigger CPU exhaustion through malicious regex pattern...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity DoS vulnerability in Spring Framework's deserialization of regex patterns. The vulnerability existed when JdkRegexpMethodPointcut stored Pattern[] fields as transient and recompiled them from untrusted strings during deserialization via a custom readObject() method. This allowed attackers to trigger CPU exhaustion through malicious regex pattern..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-06T17:31:17.527478+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.21 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.1.21 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T09:40:00.094131+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2011-2894. The vulnerable RMI remoting infrastructure (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream, and the entire org.springframework.remoting.rmi package) was completely removed in Spring Framework 6.0 (commit 5822f1bf, September 2021) by upstream developer Juergen Hoeller. The CVE specifically targets unsafe deserializati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2011-2894. The vulnerable RMI remoting infrastructure (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream, and the entire org.springframework.remoting.rmi package) was completely removed in Spring Framework 6.0 (commit 5822f1bf, September 2021) by upstream developer Juergen Hoeller. The CVE specifically targets unsafe deserializati..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2014-3578. The vulnerability affected versions 3.x before 3.2.9 and 4.0 before 4.0.5. The security fix (rejecting URI-scheme prefixes containing \"/\" to prevent path traversal) was introduced by upstream in May 2014 (commit 8ee4651038 by Rossen Stoyanchev) and is present in all subsequent versions. Version 6.1.21 inherited this fix from upstream rel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2014-3578. The vulnerability affected versions 3.x before 3.2.9 and 4.0 before 4.0.5. The security fix (rejecting URI-scheme prefixes containing \"/\" to prevent path traversal) was introduced by upstream in May 2014 (commit 8ee4651038 by Rossen Stoyanchev) and is present in all subsequent versions. Version 6.1.21 inherited this fix from upstream rel..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T19:06:19.212631+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS Java client used AlternativeJdkIdGenerator for session ID generation. This generator used SecureRandom only for the initial seed, then java.util.Random for all subsequent IDs, making them predictable. The vulnerability was fixed by upstream vendor (Rossen Stoyanchev, Pivotal) in commit 52b8f34468 (January 2015) by replac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5 where the SockJS Java client used AlternativeJdkIdGenerator for session ID generation. This generator used SecureRandom only for the initial seed, then java.util.Random for all subsequent IDs, making them predictable. The vulnerability was fixed by upstream vendor (Rossen Stoyanchev, Pivotal) in commit 52b8f34468 (January 2015) by replac..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:58:17.463230+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2015-5211 (Reflected File Download attack). The vulnerability was fixed in upstream commit 2bd1daa75e (October 2015) which shipped in the upstream release before TuxCare onboarded this version. The fix adds Content-Disposition headers for responses with non-whitelisted file extensions, preventing malicious files from being downloaded with dangerous extensions (.bat, .cmd, etc.). The defense code is present and active in the current version at AbstractMessageConverterMethodProcessor.java:438-476, with the SAFE_EXTENSIONS whitelist at lines 82-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2015-5211 (Reflected File Download attack). The vulnerability was fixed in upstream commit 2bd1daa75e (October 2015) which shipped in the upstream release before TuxCare onboarded this version. The fix adds Content-Disposition headers for responses with non-whitelisted file extensions, preventing malicious files from being downloaded with dangerous extensions (.bat, .cmd, etc.). The defense code is present and active in the current version at AbstractMessageConverterMethodProcessor.java:438-476, with the SAFE_EXTENSIONS whitelist at lines 82-85.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:10:32.786596+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. Spring Framework 6.1.21-tuxcare.16 is NOT affected by CVE-2016-5007. The upstream fix (commit a30ab30e4e introducing HandlerMappingIntrospector and MatchableHandlerMapping) shipped in the upstream release that TuxCare onboarded. The fix provides a standardized introspection API that eliminates URL pattern matching inconsistencies between Spring Security (authorization) and Spring MVC (request routing), preventing authorization bypass attacks. Both AbstractUrlHandlerMapping and RequestMappingHandlerMapping implement the MatchableHandlerMapping interface with the match() method, allowing Spring Security to align its pattern matching with Spring MVC's logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 6.1.21-tuxcare.16 is NOT affected by CVE-2016-5007. The upstream fix (commit a30ab30e4e introducing HandlerMappingIntrospector and MatchableHandlerMapping) shipped in the upstream release that TuxCare onboarded. The fix provides a standardized introspection API that eliminates URL pattern matching inconsistencies between Spring Security (authorization) and Spring MVC (request routing), preventing authorization bypass attacks. Both AbstractUrlHandlerMapping and RequestMappingHandlerMapping implement the MatchableHandlerMapping interface with the match() method, allowing Spring Security to align its pattern matching with Spring MVC's logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:52:54.438603+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. Spring Framework 6.1.21 is not affected by CVE-2018-11040. The vulnerability affected versions prior to 4.3.18 and 5.0.7 where JSONP support was automatically enabled in MappingJackson2JsonView. The upstream Spring Framework project completely removed all JSONP support in version 5.1 (commit ac37b678a3 by Sebastien Deleuze), well before the 6.1.x release line. The target codebase contains no JSONP-related code: MappingJackson2JsonView has no jsonpParameterNames field, AbstractJsonpResponseBodyAdvice does not exist, and all JSONP support classes have been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.1.21 is not affected by CVE-2018-11040. The vulnerability affected versions prior to 4.3.18 and 5.0.7 where JSONP support was automatically enabled in MappingJackson2JsonView. The upstream Spring Framework project completely removed all JSONP support in version 5.1 (commit ac37b678a3 by Sebastien Deleuze), well before the 6.1.x release line. The target codebase contains no JSONP-related code: MappingJackson2JsonView has no jsonpParameterNames field, AbstractJsonpResponseBodyAdvice does not exist, and all JSONP support classes have been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T00:57:00.145479+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in spring-framework 6.1.21-tuxcare.16. The vulnerability, which allowed bypassing security constraints through specially-encoded URL path separators and traversal sequences, was fixed in the upstream Spring Framework release that TuxCare onboarded. The fix (SPR-16616, commit 0e28bee0f1 by Rossen Stoyanchev) was already present in Spring Framework 6.1.x before TuxCar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in spring-framework 6.1.21-tuxcare.16. The vulnerability, which allowed bypassing security constraints through specially-encoded URL path separators and traversal sequences, was fixed in the upstream Spring Framework release that TuxCare onboarded. The fix (SPR-16616, commit 0e28bee0f1 by Rossen Stoyanchev) was already present in Spring Framework 6.1.x before TuxCar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T09:05:51.109874+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 concerns a regular expression denial of service (ReDoS) vulnerability in Spring Framework's STOMP over WebSocket messaging module, where malicious selector header values in subscription messages could cause excessive CPU consumption during SpEL expression parsing. The target repository (Spring Framework 6.1.21) is not affected because both the original fix (commit ff2228fdaf - add...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 concerns a regular expression denial of service (ReDoS) vulnerability in Spring Framework's STOMP over WebSocket messaging module, where malicious selector header values in subscription messages could cause excessive CPU consumption during SpEL expression parsing. The target repository (Spring Framework 6.1.21) is not affected because both the original fix (commit ff2228fdaf - add..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. Target version 6.1.21-tuxcare.16 is not affected by CVE-2018-1258. The vulnerability (authorization bypass in method security due to incorrect method resolution for JDK dynamic proxy classes) was fixed in upstream Spring Framework commit aa11721ff0 on April 27, 2018, years before this version was released. All three key components of the fix are present: (1) AopUtils.getMostSpecificMethod properly handles proxy classes, (2) AnnotationMethodMatcher has proxy class early return, and (3) CacheAspectSupport has proper targetMethod resolution. The fix was already in the upstream release when TuxCare onboarded the code in October 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Target version 6.1.21-tuxcare.16 is not affected by CVE-2018-1258. The vulnerability (authorization bypass in method security due to incorrect method resolution for JDK dynamic proxy classes) was fixed in upstream Spring Framework commit aa11721ff0 on April 27, 2018, years before this version was released. All three key components of the fix are present: (1) AopUtils.getMostSpecificMethod properly handles proxy classes, (2) AnnotationMethodMatcher has proxy class early return, and (3) CacheAspectSupport has proper targetMethod resolution. The fix was already in the upstream release when TuxCare onboarded the code in October 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-30T18:35:35.339720+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2018-1271. The vulnerability (Windows directory traversal via backslash path separators) was fixed in upstream Spring Framework by commit 91b803a2310344d925e5d4b1709bbcea90375548 (author: jhoeller@pivotal.io) before version 6.1.21 was released. The target contains both required defenses: backslash-to-forward-slash normalization and rejection of URL...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2018-1271. The vulnerability (Windows directory traversal via backslash path separators) was fixed in upstream Spring Framework by commit 91b803a2310344d925e5d4b1709bbcea90375548 (author: jhoeller@pivotal.io) before version 6.1.21 was released. The target contains both required defenses: backslash-to-forward-slash normalization and rejection of URL..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. CVE-2018-1272: Target Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED. The vulnerability involves predictable multipart boundaries generated with weak Random, allowing attackers to inject extra multipart sections and manipulate part values (privilege escalation). The target uses SecureRandom (not weak Random) to generate boundaries in MimeTypeUtils.generateMultipartBoundary(), making boundaries cryptographically unpredictable. The fix (commit ab2410c754) was authored by upstream Spring developer rstoyanchev@pivotal.io and shipped in the upstream release that TuxCare onboarded (first TuxCare commit d48bec5394 is after the fix). All production multipart code paths delegate to MimeTypeUtils.generateMultipartBoundary() \u2192 initRandom() \u2192 new SecureRandom(). No weak Random usage exists in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272: Target Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED. The vulnerability involves predictable multipart boundaries generated with weak Random, allowing attackers to inject extra multipart sections and manipulate part values (privilege escalation). The target uses SecureRandom (not weak Random) to generate boundaries in MimeTypeUtils.generateMultipartBoundary(), making boundaries cryptographically unpredictable. The fix (commit ab2410c754) was authored by upstream Spring developer rstoyanchev@pivotal.io and shipped in the upstream release that TuxCare onboarded (first TuxCare commit d48bec5394 is after the fix). All production multipart code paths delegate to MimeTypeUtils.generateMultipartBoundary() \u2192 initRandom() \u2192 new SecureRandom(). No weak Random usage exists in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T13:33:56.225785+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. CVE-2018-15756 is not present in Spring Framework 6.1.21-tuxcare.16. The upstream fix (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e) was already included in the upstream release that TuxCare onboarded. The fix adds two critical validations to HttpRange.java: (1) limits the number of ranges per request to 100, and (2) validates that the sum of all range sizes is less than the resource length, preventing DoS attacks via malicious Range headers with excessive or overlapping ranges.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "CVE-2018-15756 is not present in Spring Framework 6.1.21-tuxcare.16. The upstream fix (commit 423aa28ed584b4ff6e5bad218c09beef5e91951e) was already included in the upstream release that TuxCare onboarded. The fix adds two critical validations to HttpRange.java: (1) limits the number of ranges per request to 100, and (2) validates that the sum of all range sizes is less than the resource length, preventing DoS attacks via malicious Range headers with excessive or overlapping ranges.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-31T20:22:00.099756+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2021-22060 (log injection vulnerability). The upstream vendor fix that sanitizes newlines and control characters in user input before logging was already present in the upstream Spring Framework release before TuxCare onboarded version 6.1.21. The fix commit e9083d7d20 by upstream developer rstoyanchev@vmware.com introduced LogFormatUtils with NEWL...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2021-22060 (log injection vulnerability). The upstream vendor fix that sanitizes newlines and control characters in user input before logging was already present in the upstream Spring Framework release before TuxCare onboarded version 6.1.21. The fix commit e9083d7d20 by upstream developer rstoyanchev@vmware.com introduced LogFormatUtils with NEWL..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-31T21:24:03.236873+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.1.21-tuxcare.16 is not affected by CVE-2021-22096 (log injection via malicious input). The vulnerability allowed attackers to inject newline and control characters into log entries through user-controlled paths, URLs, and headers. The fix was already present in upstream v6.1.21 (commits e9083d7d20 and 05ea991d62 by Rossen Stoyanchev) before TuxCare onboarded this version. All...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.21-tuxcare.16 is not affected by CVE-2021-22096 (log injection via malicious input). The vulnerability allowed attackers to inject newline and control characters into log entries through user-controlled paths, URLs, and headers. The fix was already present in upstream v6.1.21 (commits e9083d7d20 and 05ea991d62 by Rossen Stoyanchev) before TuxCare onboarded this version. All..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.1.21-tuxcare.6 of org.springframework:spring-core. CVE-2024-22233 describes two DoS vectors via unhandled exceptions in Spring Framework 6.0.15 and 6.1.2: (1) malformed forwarded headers causing uncaught parsing exceptions in ForwardedHeaderFilter, and (2) URIs with regex metacharacters causing PatternSyntaxException in HandlerMappingIntrospector. Analysis of the target (Spring Framework 6.1.21-tuxcare.16) confirms BOTH fixes are present: ForwardedHeaderFilter wraps header parsing in try-catch and returns HTTP 400 on errors (lines 160-172), and HandlerMappingIntrospector uses String.equals() instead of String.matches() for URI comparison (line 402). Both fixes were authored by upstream vendor (brian.clozel@broadcom.com) and committed to the upstream Spring Framework release BEFORE TuxCare onboarded it (first TuxCare commit d48bec5394b on 2024-01-04). Therefore, the vulnerable patterns are not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 describes two DoS vectors via unhandled exceptions in Spring Framework 6.0.15 and 6.1.2: (1) malformed forwarded headers causing uncaught parsing exceptions in ForwardedHeaderFilter, and (2) URIs with regex metacharacters causing PatternSyntaxException in HandlerMappingIntrospector. Analysis of the target (Spring Framework 6.1.21-tuxcare.16) confirms BOTH fixes are present: ForwardedHeaderFilter wraps header parsing in try-catch and returns HTTP 400 on errors (lines 160-172), and HandlerMappingIntrospector uses String.equals() instead of String.matches() for URI comparison (line 402). Both fixes were authored by upstream vendor (brian.clozel@broadcom.com) and committed to the upstream Spring Framework release BEFORE TuxCare onboarded it (first TuxCare commit d48bec5394b on 2024-01-04). Therefore, the vulnerable patterns are not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.1.21-tuxcare.6 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.1.21-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.1.21-tuxcare.6 of org.springframework:spring-core, and is fixed in 6.1.21-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.1.21-tuxcare.6 of org.springframework:spring-core, and is fixed in 6.1.21-tuxcare.7."
    }
  ]
}