{
  "@id": "urn:uuid:2364732c-e5cc-4a4f-bbf6-c5c67e6a11d8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:38:00.045928+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T12:40:58.410561+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2009-1190. This CVE exploits an algorithmic complexity vulnerability in JDK regex engines before Java 1.6. Spring Framework 6.2.1 requires Java 17+ (enforced by sourceCompatibility=17 in build.gradle), making it impossible to run on the vulnerable JDK versions. While the codebase still contains serializable classes (JdkRegexpMethodPointcut) that com...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2009-1190. This CVE exploits an algorithmic complexity vulnerability in JDK regex engines before Java 1.6. Spring Framework 6.2.1 requires Java 17+ (enforced by sourceCompatibility=17 in build.gradle), making it impossible to run on the vulnerable JDK versions. While the codebase still contains serializable classes (JdkRegexpMethodPointcut) that com..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:38:00.045928+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:49:00.106689+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.1-tuxcare.6 is not affected by CVE-2011-2894. The vulnerability, which allowed arbitrary code execution via deserialization of untrusted proxy classes, was fixed by upstream Spring Framework in July 2011 (commit 7d8aa05c40, v3.2.0.M1). The fix added an acceptProxyClasses configuration flag and validation logic in ConfigurableObjectInputStream.resolveProxyClass() that throws...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.1-tuxcare.6 is not affected by CVE-2011-2894. The vulnerability, which allowed arbitrary code execution via deserialization of untrusted proxy classes, was fixed by upstream Spring Framework in July 2011 (commit 7d8aa05c40, v3.2.0.M1). The fix added an acceptProxyClasses configuration flag and validation logic in ConfigurableObjectInputStream.resolveProxyClass() that throws..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 6.2.1-tuxcare.6. The directory traversal vulnerability was fixed by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev @gopivotal.com, May 2014), which added validation to StringUtils.cleanPath() that rejects path prefixes containing forward slashes. This fix was already included in the upstream release that T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3578 is NOT present in Spring Framework 6.2.1-tuxcare.6. The directory traversal vulnerability was fixed by upstream commit 8ee465103850a3dca018273fe5952e40d5c45a66 (authored by Rossen Stoyanchev @gopivotal.com, May 2014), which added validation to StringUtils.cleanPath() that rejects path prefixes containing forward slashes. This fix was already included in the upstream release that T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:14:03.234394+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client used AlternativeJdkIdGenerator for session IDs. This generator used SecureRandom only for the initial seed, then predictable java.util.Random thereafter, allowing attackers to predict session IDs and send messages to other users' sessions. The target (version 6.2.1-tuxcare.6) uses JdkIdGenerator with UUID.randomU...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client used AlternativeJdkIdGenerator for session IDs. This generator used SecureRandom only for the initial seed, then predictable java.util.Random thereafter, allowing attackers to predict session IDs and send messages to other users' sessions. The target (version 6.2.1-tuxcare.6) uses JdkIdGenerator with UUID.randomU..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:04:07.366670+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.1-tuxcare.6 is NOT affected by CVE-2015-5211 (Reflected File Download). The RFD vulnerability fix was already present in the upstream Spring Framework 6.2.1 release that TuxCare onboarded. The fix (commit 2bd1daa7 by Rossen Stoyanchev, October 2015) implements comprehensive protection: it strips path parameters from URLs before extension validation, checks both filename and path parameter extensions against a SAFE_EXTENSIONS whitelist, and adds Content-Disposition headers for unsafe extensions. Additionally, JSONP support (another CVE-2015-5211 attack vector) has been completely removed from Spring 6.x, providing even stronger protection than the original 2015 patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.2.1-tuxcare.6 is NOT affected by CVE-2015-5211 (Reflected File Download). The RFD vulnerability fix was already present in the upstream Spring Framework 6.2.1 release that TuxCare onboarded. The fix (commit 2bd1daa7 by Rossen Stoyanchev, October 2015) implements comprehensive protection: it strips path parameters from URLs before extension validation, checks both filename and path parameter extensions against a SAFE_EXTENSIONS whitelist, and adds Content-Disposition headers for unsafe extensions. Additionally, JSONP support (another CVE-2015-5211 attack vector) has been completely removed from Spring 6.x, providing even stronger protection than the original 2015 patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:16:19.686333+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.1-tuxcare.6 is not affected by CVE-2016-5007. The vulnerability concerns URL pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass. The fix (introducing MatchableHandlerMapping interface and HandlerMappingIntrospector class to align pattern matching) was already included in the upstream Spring Framework 6.2.1 release that TuxCare onboarded. The fix was authored by Juergen Hoeller (jhoeller@pivotal.io) and is present at commit 16949941f8, which predates TuxCare's first commit (c6d2beb723 \"Onboard version 6.2.1\"). All required implementations are complete and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "Spring Framework 6.2.1-tuxcare.6 is not affected by CVE-2016-5007. The vulnerability concerns URL pattern matching discrepancies between Spring Security and Spring MVC that could lead to authorization bypass. The fix (introducing MatchableHandlerMapping interface and HandlerMappingIntrospector class to align pattern matching) was already included in the upstream Spring Framework 6.2.1 release that TuxCare onboarded. The fix was authored by Juergen Hoeller (jhoeller@pivotal.io) and is present at commit 16949941f8, which predates TuxCare's first commit (c6d2beb723 \"Onboard version 6.2.1\"). All required implementations are complete and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:06.230787+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.1 is not affected by CVE-2018-11040. The entire JSONP functionality was completely removed from the codebase in Spring Framework 5.1.0 (June 2018) via upstream commit ac37b678a3. The target version (6.2.1) contains this upstream fix as part of its base release. The vulnerable code patterns no longer exist: MappingJackson2JsonView lacks the jsonpParameterNames field and all JSONP-related methods, MappingJacksonValue lacks jsonpFunction methods, and AbstractJsonpResponseBodyAdvice class has been entirely removed. No query parameters can trigger JSONP wrapping because the feature is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.2.1 is not affected by CVE-2018-11040. The entire JSONP functionality was completely removed from the codebase in Spring Framework 5.1.0 (June 2018) via upstream commit ac37b678a3. The target version (6.2.1) contains this upstream fix as part of its base release. The vulnerable code patterns no longer exist: MappingJackson2JsonView lacks the jsonpParameterNames field and all JSONP-related methods, MappingJacksonValue lacks jsonpFunction methods, and AbstractJsonpResponseBodyAdvice class has been entirely removed. No query parameters can trigger JSONP wrapping because the feature is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:07:56.973372+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.1-tuxcare.6 is NOT affected by CVE-2018-1199. The vulnerability concerned bypassing security constraints via URL path parameters with special encodings (duplicate slashes, backslashes, encoded path traversal sequences). The upstream fix (SPR-16616, committed March 2018 by Rossen Stoyanchev @pivotal.io) was already present in the Spring Framework 6.2.1 release that TuxCare o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.1-tuxcare.6 is NOT affected by CVE-2018-1199. The vulnerability concerned bypassing security constraints via URL path parameters with special encodings (duplicate slashes, backslashes, encoded path traversal sequences). The upstream fix (SPR-16616, committed March 2018 by Rossen Stoyanchev @pivotal.io) was already present in the Spring Framework 6.2.1 release that TuxCare o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.1 is NOT vulnerable to CVE-2018-1257. The vulnerability involved a ReDoS (Regular Expression Denial of Service) attack via crafted Spring EL expressions in STOMP subscription selector headers. The target version contains upstream commit 5bc80fc094 (Sam Brannen, June 2023) that disables SpEL selector support by default. The vulnerable pattern (enabled-by-default selector hea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.1 is NOT vulnerable to CVE-2018-1257. The vulnerability involved a ReDoS (Regular Expression Denial of Service) attack via crafted Spring EL expressions in STOMP subscription selector headers. The target version contains upstream commit 5bc80fc094 (Sam Brannen, June 2023) that disables SpEL selector support by default. The vulnerable pattern (enabled-by-default selector hea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 affects Spring Framework 5.0.5 where AopUtils.getMostSpecificMethod() failed to resolve the underlying target method for proxy classes, causing Spring Security method-level annotations to be missed. The target version 6.2.1-tuxcare.6 contains the upstream fix (commit aa11721ff0 by Juergen Hoeller) which ensures proper method resolution even for proxy instances. The fix was shipped in the upstream Spring Framework release that TuxCare onboarded, not applied as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 affects Spring Framework 5.0.5 where AopUtils.getMostSpecificMethod() failed to resolve the underlying target method for proxy classes, causing Spring Security method-level annotations to be missed. The target version 6.2.1-tuxcare.6 contains the upstream fix (commit aa11721ff0 by Juergen Hoeller) which ensures proper method resolution even for proxy instances. The fix was shipped in the upstream Spring Framework release that TuxCare onboarded, not applied as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T18:50:00.206758+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 6.2.1-tuxcare.6. The fix was already included in the upstream Spring Framework 6.2.1 release (2024), years after the CVE was published (2018). The defensive code that validates and rejects URL-encoded directory traversal sequences (\"../\" and \"..\\\") exists in ResourceHandlerUtils.isInvalidEncodedResourcePath() and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 6.2.1-tuxcare.6. The fix was already included in the upstream Spring Framework 6.2.1 release (2024), years after the CVE was published (2018). The defensive code that validates and rejects URL-encoded directory traversal sequences (\"../\" and \"..\\\") exists in ResourceHandlerUtils.isInvalidEncodedResourcePath() and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. CVE-2018-1272 affects Spring Framework versions that use predictable Random() for generating multipart boundaries, allowing attackers to predict boundaries and inject malicious multipart content. The target Spring Framework 6.2.1 is NOT AFFECTED because the vulnerability was fixed in upstream commit ab2410c754b67902f002bfcc0c3895bd7772d39f (authored by rstoyanchev@pivotal.io), which replaced Random() with SecureRandom(). This fix was already included in the upstream 6.2.1 release that TuxCare onboarded (first TuxCare commit: c6d2beb723ff8eca40422ea3ccc622c24f5fec85 \"Onboard version 6.2.1\"). The current implementation uses lazy initialization with SecureRandom (MimeTypeUtils.java lines 401-413), making boundaries cryptographically unpredictable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "CVE-2018-1272 affects Spring Framework versions that use predictable Random() for generating multipart boundaries, allowing attackers to predict boundaries and inject malicious multipart content. The target Spring Framework 6.2.1 is NOT AFFECTED because the vulnerability was fixed in upstream commit ab2410c754b67902f002bfcc0c3895bd7772d39f (authored by rstoyanchev@pivotal.io), which replaced Random() with SecureRandom(). This fix was already included in the upstream 6.2.1 release that TuxCare onboarded (first TuxCare commit: c6d2beb723ff8eca40422ea3ccc622c24f5fec85 \"Onboard version 6.2.1\"). The current implementation uses lazy initialization with SecureRandom (MimeTypeUtils.java lines 401-413), making boundaries cryptographically unpredictable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:04.560309+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.1 is not affected by CVE-2018-15756. The vulnerability (DoS via malicious Range headers with excessive or overlapping ranges) was fixed in the upstream codebase via commit 423aa28ed5 by Rossen Stoyanchev (Pivotal), which was included in the Spring Framework 6.2.1 release before TuxCare onboarding (commit c6d2beb723ff). The fix implements two validations in HttpRange.java: (1) maximum 100 ranges limit, and (2) rejection when sum of range lengths >= resource content length. Both validations are present and active in the request processing flow through ResourceHttpRequestHandler.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework 6.2.1 is not affected by CVE-2018-15756. The vulnerability (DoS via malicious Range headers with excessive or overlapping ranges) was fixed in the upstream codebase via commit 423aa28ed5 by Rossen Stoyanchev (Pivotal), which was included in the Spring Framework 6.2.1 release before TuxCare onboarding (commit c6d2beb723ff). The fix implements two validations in HttpRange.java: (1) maximum 100 ranges limit, and (2) rejection when sum of range lengths >= resource content length. Both validations are present and active in the request processing flow through ResourceHttpRequestHandler.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T20:44:10.208770+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2021-22060. The upstream fix (commit e9083d7d20) was already present in the 6.2.1 release when TuxCare onboarded it. The fix introduces LogFormatUtils.formatValue() which sanitizes user-controlled input by replacing newline characters with &lt;EOL&gt; and control characters with ? before logging, preventing log injection attacks. All critical code p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2021-22060. The upstream fix (commit e9083d7d20) was already present in the 6.2.1 release when TuxCare onboarded it. The fix introduces LogFormatUtils.formatValue() which sanitizes user-controlled input by replacing newline characters with &lt;EOL&gt; and control characters with ? before logging, preventing log injection attacks. All critical code p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:34:17.947024+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2021-22096. The log injection vulnerability was fixed by upstream Spring Framework developers before version 6.2.1 was released. The fixes include enhancing LogFormatUtils to sanitize newlines and control characters (commit 99c7608ffe7) and applying it to vulnerable logging locations (commit e9083d7d2053). These upstream fixes were already present w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2021-22096. The log injection vulnerability was fixed by upstream Spring Framework developers before version 6.2.1 was released. The fixes include enhancing LogFormatUtils to sanitize newlines and control characters (commit 99c7608ffe7) and applying it to vulnerable logging locations (commit e9083d7d2053). These upstream fixes were already present w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.1-tuxcare.2 of org.springframework:spring-core. CVE-2024-22233 affects Spring Framework versions 6.0.15 and 6.1.2, where specially crafted HTTP requests can cause DoS. The target version 6.2.1-tuxcare.6 is NOT affected because both vulnerability patterns were fixed in the upstream Spring Framework 6.2.1 release before TuxCare onboarded it. The fixes (commits 4afac17e58 and 7c9307e970) were authored by upstream Spring Framework maintainer Brian Clozel from Broadcom and shipped in the v6.2.1 release on 2024-12-12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 affects Spring Framework versions 6.0.15 and 6.1.2, where specially crafted HTTP requests can cause DoS. The target version 6.2.1-tuxcare.6 is NOT affected because both vulnerability patterns were fixed in the upstream Spring Framework 6.2.1 release before TuxCare onboarded it. The fixes (commits 4afac17e58 and 7c9307e970) were authored by upstream Spring Framework maintainer Brian Clozel from Broadcom and shipped in the v6.2.1 release on 2024-12-12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.2.1-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.2.1-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.2.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.2.1-tuxcare.2 of org.springframework:spring-core, and is fixed in 6.2.1-tuxcare.5."
    }
  ]
}