{
  "@id": "urn:uuid:91c6d8d1-bd55-46ac-b974-83ce82acae8e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 46,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:40:25.193904+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T13:00:26.830408+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2009-1190. The vulnerability's attack vector\u2014Java serialization-based Spring Remoting (HttpInvoker, RMI, Hessian) accepting untrusted serialized objects from remote attackers over HTTP\u2014has been completely removed from Spring Framework. These remoting technologies were deprecated in Spring 5.3 (July 2020) and removed entirely in Spring 6.0 (2022). Ad...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2009-1190. The vulnerability's attack vector\u2014Java serialization-based Spring Remoting (HttpInvoker, RMI, Hessian) accepting untrusted serialized objects from remote attackers over HTTP\u2014has been completely removed from Spring Framework. These remoting technologies were deprecated in Spring 5.3 (July 2020) and removed entirely in Spring 6.0 (2022). Ad..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:40:25.193904+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 6.2.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T09:54:00.051000+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2011-2894. The vulnerability affected versions 3.0.0-3.0.5 via RMI remoting endpoints that deserialized untrusted proxy classes. In version 6.2.5: (1) RMI remoting components (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) were deprecated in 2020 and completely removed, (2) ConfigurableObjectInputStream includes the acceptProxy...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2011-2894. The vulnerability affected versions 3.0.0-3.0.5 via RMI remoting endpoints that deserialized untrusted proxy classes. In version 6.2.5: (1) RMI remoting components (RemoteInvocationSerializingExporter, CodebaseAwareObjectInputStream) were deprecated in 2020 and completely removed, (2) ConfigurableObjectInputStream includes the acceptProxy..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.5 is NOT affected by CVE-2014-3578. The vulnerability was a directory traversal issue in the StringUtils.cleanPath() method that allowed attackers to read arbitrary files via crafted URLs with malformed prefixes. The fix (adding validation to reject pseudo-prefixes containing '/') was applied upstream in May 2014 and has been present in all Spring Framework releases since v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.5 is NOT affected by CVE-2014-3578. The vulnerability was a directory traversal issue in the StringUtils.cleanPath() method that allowed attackers to read arbitrary files via crafted URLs with malformed prefixes. The fix (adding validation to reject pseudo-prefixes containing '/') was applied upstream in May 2014 and has been present in all Spring Framework releases since v..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:19:36.318385+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 describes predictable session ID generation in Spring Framework's Java SockJS client (versions 4.1.x before 4.1.5). The vulnerability existed when the client used AlternativeJdkIdGenerator, which employed SecureRandom only for the initial seed, then used predictable java.util.Random for subsequent ID generation. The fix (commit d63cfc8eeb, January 2015) switched to JdkIdGenerator,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 describes predictable session ID generation in Spring Framework's Java SockJS client (versions 4.1.x before 4.1.5). The vulnerability existed when the client used AlternativeJdkIdGenerator, which employed SecureRandom only for the initial seed, then used predictable java.util.Random for subsequent ID generation. The fix (commit d63cfc8eeb, January 2015) switched to JdkIdGenerator,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.5 is not affected by CVE-2015-5211 (Reflected File Download vulnerability). The fix for this vulnerability was committed to the Spring Framework repository in October 2015 (commit 2bd1daa75e \"Protect against RFD exploits\", issue SPR-13548) by upstream maintainer Rossen Stoyanchev. This fix is present in Spring Framework 6.2.5, which was released years later. The defensive code includes: (1) Content-Disposition header injection with safe filename when URL contains unsafe extensions, (2) SAFE_EXTENSIONS whitelist (txt, json, xml, etc.), (3) JSONP callback parameter validation, and (4) proper filename extraction handling path/query parameters. The fix commit 2bd1daa75e is an ancestor of both the current HEAD and the TuxCare onboarding commit a47acaade5 (\"Onboard version 6.2.5\"), confirming the fix was already in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "impact_statement": "Spring Framework 6.2.5 is not affected by CVE-2015-5211 (Reflected File Download vulnerability). The fix for this vulnerability was committed to the Spring Framework repository in October 2015 (commit 2bd1daa75e \"Protect against RFD exploits\", issue SPR-13548) by upstream maintainer Rossen Stoyanchev. This fix is present in Spring Framework 6.2.5, which was released years later. The defensive code includes: (1) Content-Disposition header injection with safe filename when URL contains unsafe extensions, (2) SAFE_EXTENSIONS whitelist (txt, json, xml, etc.), (3) JSONP callback parameter validation, and (4) proper filename extraction handling path/query parameters. The fix commit 2bd1daa75e is an ancestor of both the current HEAD and the TuxCare onboarding commit a47acaade5 (\"Onboard version 6.2.5\"), confirming the fix was already in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0, < 4.2.2; >= 4.0.0, < 4.1.8; < 3.2.15), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.2.0; = 4.2.1), Snyk (>= 3.2.0.RELEASE, < 3.2.15.RELEASE; >= 4.0.0.RELEASE, < 4.1.8.RELEASE; >= 4.2.0.RELEASE, < 4.2.2.RELEASE; <= 0; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:18:44.496921+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. CVE-2016-5007 affects Spring Framework 3.2.x-4.2.x due to pattern matching differences between Spring Security and Spring MVC that could allow authorization bypass. The vulnerability arises when Spring Security's URL pattern matching (used for authorization decisions) differs from Spring MVC's pattern matching (used for handler routing), particularly regarding space trimming and trailing slashes. Target version 6.2.5 is NOT affected because the fix was introduced in upstream Spring Framework v4.3.1.RELEASE (commit a30ab30e4e by Rossen Stoyanchev, April 2016) and is present in all subsequent versions including 6.2.5. The fix provides HandlerMappingIntrospector API allowing Spring Security to use the exact same pattern matching logic as Spring MVC, eliminating the mismatch. TuxCare has separately backported this fix to older EOL versions (3.0.5, 3.1.1, 4.0.0, 4.1.7, 4.2.9) but version 6.2.5 inherited it from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 affects Spring Framework 3.2.x-4.2.x due to pattern matching differences between Spring Security and Spring MVC that could allow authorization bypass. The vulnerability arises when Spring Security's URL pattern matching (used for authorization decisions) differs from Spring MVC's pattern matching (used for handler routing), particularly regarding space trimming and trailing slashes. Target version 6.2.5 is NOT affected because the fix was introduced in upstream Spring Framework v4.3.1.RELEASE (commit a30ab30e4e by Rossen Stoyanchev, April 2016) and is present in all subsequent versions including 6.2.5. The fix provides HandlerMappingIntrospector API allowing Spring Security to use the exact same pattern matching logic as Spring MVC, eliminating the mismatch. TuxCare has separately backported this fix to older EOL versions (3.0.5, 3.1.1, 4.0.0, 4.1.7, 4.2.9) but version 6.2.5 inherited it from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.1), NVD (= 3.2.0; = 4.0.0; = 4.1.0; = 4.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 3.2.11; = 3.2.12; = 3.2.13; = 3.2.14; = 3.2.15; = 3.2.16; = 3.2.17; = 3.2.18; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.1.1; = 4.1.2; = 4.1.3; = 4.1.4; = 4.1.5; = 4.1.6; = 4.1.7; = 4.1.8; = 4.1.9; = 4.2.1; = 4.2.2; = 4.2.3; = 4.2.4; = 4.2.5; = 4.2.6; = 4.2.7; = 4.2.8; = 4.2.9), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; >= 4.1, < 4.2; >= 4.2, < 4.3; < 3.2), Snyk (>= 3.2.0.RELEASE, < 4.3.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T14:01:13.058306+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.5 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed by upstream in version 5.1.0 (commit ac37b678a3, June 2018) - years before version 6.2.5 was released. The target codebase contains no JSONP parameter processing code, no AbstractJsonpResponseBodyAdvice class, and no jsonpParameterNames field in MappingJackson2JsonView. The vulnerability affected versions 4.3.x prior to 4.3.18 and 5.0.x prior to 5.0.7; version 6.2.5 never had this code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "impact_statement": "Spring Framework 6.2.5 is not affected by CVE-2018-11040. The vulnerable JSONP functionality was completely removed by upstream in version 5.1.0 (commit ac37b678a3, June 2018) - years before version 6.2.5 was released. The target codebase contains no JSONP parameter processing code, no AbstractJsonpResponseBodyAdvice class, and no jsonpParameterNames field in MappingJackson2JsonView. The vulnerability affected versions 4.3.x prior to 4.3.18 and 5.0.x prior to 5.0.7; version 6.2.5 never had this code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE), NVD (< 4.3.18; >= 5.0.0, < 5.0.7), cve.org (>= 5.0.x, < 5.0.7; >= 4.3.x, < 4.3.18), Snyk (>= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE; >= 4.3.0.RELEASE, < 4.3.18.RELEASE; >= 5.0.0.RELEASE, < 5.0.7.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:13:00.113752+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 6.2.5. The vulnerability involved bypassing security constraints using malformed URL paths (duplicate slashes, backslashes, encoded traversal sequences). The upstream vendor fix, authored by Rossen Stoyanchev (rstoyanchev@pivotal.io), was already included in Spring Framework 6.2.5 when TuxCare onboarded the version. The fix implements path normal...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1199 is not present in Spring Framework 6.2.5. The vulnerability involved bypassing security constraints using malformed URL paths (duplicate slashes, backslashes, encoded traversal sequences). The upstream vendor fix, authored by Rossen Stoyanchev (rstoyanchev@pivotal.io), was already included in Spring Framework 6.2.5 when TuxCare onboarded the version. The fix implements path normal..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2018-1257. The vulnerability (ReDoS via SpEL selector expression parsing in STOMP WebSocket messaging) has been mitigated by an upstream fix that disables SpEL selector support by default. The fix commit 5bc80fc094 by Sam Brannen shipped in the upstream 6.2.5 release before TuxCare onboarded it. The vulnerable code pattern (always-enabled selector p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2018-1257. The vulnerability (ReDoS via SpEL selector expression parsing in STOMP WebSocket messaging) has been mitigated by an upstream fix that disables SpEL selector support by default. The fix commit 5bc80fc094 by Sam Brannen shipped in the upstream 6.2.5 release before TuxCare onboarded it. The vulnerable code pattern (always-enabled selector p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. CVE-2018-1258 is not present in Spring Framework 6.2.5-tuxcare.4. This authorization bypass vulnerability affected Spring Framework 5.0.5 when using method security. The vulnerability stemmed from incorrect method resolution when the target class is a JDK dynamic proxy, causing security annotations to be missed during authorization checks. All fixes from upstream patches f2e77c292d and 8b051ab06e are present in the target code. The fix was shipped in the upstream Spring Framework release before TuxCare onboarded version 6.2.5 (onboarding commit a47acaade5 by amoniatovskiy@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "CVE-2018-1258 is not present in Spring Framework 6.2.5-tuxcare.4. This authorization bypass vulnerability affected Spring Framework 5.0.5 when using method security. The vulnerability stemmed from incorrect method resolution when the target class is a JDK dynamic proxy, causing security annotations to be missed during authorization checks. All fixes from upstream patches f2e77c292d and 8b051ab06e are present in the target code. The fix was shipped in the upstream Spring Framework release before TuxCare onboarded version 6.2.5 (onboarding commit a47acaade5 by amoniatovskiy@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.5.RELEASE, < 5.0.6.RELEASE), NVD (= 5.0.5), cve.org (= 5.0.5), Snyk (>= 5.0.5.RELEASE, < 5.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:10:03.090917+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2018-1271 (Windows directory traversal via backslash separators). The vulnerability was fixed in upstream Spring Framework long before version 6.2.5 was released. The fix (backslash normalization in processPath and dual-pattern checking for both '../' and '..\\\\' in isInvalidEncodedResourcePath) is present in ResourceHandlerUtils.java in both spring-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2018-1271 (Windows directory traversal via backslash separators). The vulnerability was fixed in upstream Spring Framework long before version 6.2.5 was released. The fix (backslash normalization in processPath and dual-pattern checking for both '../' and '..\\\\' in isInvalidEncodedResourcePath) is present in ResourceHandlerUtils.java in both spring-..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:10.404462+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. Spring Framework 6.2.5 is NOT AFFECTED by CVE-2018-1272. The vulnerability required weak Random() for multipart boundary generation, allowing attackers to predict boundaries and inject malicious multipart sections. The fix (SecureRandom) was introduced by upstream Spring Framework in March 2018 (commit ab2410c754) and refined in June 2018 (commit 847202c8f8e). Version 6.2.5 already contained this fix when TuxCare onboarded it. The target uses SecureRandom for all multipart boundary generation via MimeTypeUtils.generateMultipartBoundary(), eliminating the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "impact_statement": "Spring Framework 6.2.5 is NOT AFFECTED by CVE-2018-1272. The vulnerability required weak Random() for multipart boundary generation, allowing attackers to predict boundaries and inject malicious multipart sections. The fix (SecureRandom) was introduced by upstream Spring Framework in March 2018 (commit ab2410c754) and refined in June 2018 (commit 847202c8f8e). Version 6.2.5 already contained this fix when TuxCare onboarded it. The target uses SecureRandom for all multipart boundary generation via MimeTypeUtils.generateMultipartBoundary(), eliminating the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.15; >= 5.0.0, < 5.0.5), NVD (>= 4.3.0, < 4.3.15; >= 5.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (>= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; >= 4.3.0.RELEASE, < 4.3.14.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:45:27.906732+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. Spring Framework version 6.2.5 is NOT affected by CVE-2018-15756. The vulnerability was fixed by the upstream Spring Framework team in October 2018 (commit 423aa28ed5). Spring Framework 6.2.5 was released in 2024, years after the fix, and already includes the defense mechanisms: (1) MAX_RANGES limit of 100 ranges per request, and (2) validation that sum of all range lengths is less than resource length. TuxCare onboarded the upstream 6.2.5 release which already contained this fix. The vulnerable pattern (unvalidated range processing) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "impact_statement": "Spring Framework version 6.2.5 is NOT affected by CVE-2018-15756. The vulnerability was fixed by the upstream Spring Framework team in October 2018 (commit 423aa28ed5). Spring Framework 6.2.5 was released in 2024, years after the fix, and already includes the defense mechanisms: (1) MAX_RANGES limit of 100 ranges per request, and (2) validation that sum of all range lengths is less than resource length. TuxCare onboarded the upstream 6.2.5 release which already contained this fix. The vulnerable pattern (unvalidated range processing) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0.RELEASE, < 5.1.1.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 4.2.0.RELEASE, < 4.3.20.RELEASE), NVD (>= 4.2.0, < 4.3.20; >= 5.0.0, < 5.0.10; = 5.1.0), cve.org (= 5.1; >= 5.0.0, <= 5.0.9; >= 4.3, <= 4.3.19), Snyk (>= 4.2.0.RELEASE, < 4.3.20.RELEASE; >= 5.0.0.RELEASE, < 5.0.10.RELEASE; >= 5.1.0.RELEASE, < 5.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:00:02.016689+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 CVE-2021-22060 (log injection via newline/control characters) is NOT present in Spring Framework 6.2.5. The upstream fix was shipped in the 6.2.5 release before TuxCare onboarding. LogFormatUtils.java contains NEWLINE_PATTERN and CONTROL_CHARACTER_PATTERN filtering (lines 41-43, 84-87), and LogFormatUtils.formatValue() is applied throughout the codebase to sanitize user input before logging. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22060 (log injection via newline/control characters) is NOT present in Spring Framework 6.2.5. The upstream fix was shipped in the 6.2.5 release before TuxCare onboarding. LogFormatUtils.java contains NEWLINE_PATTERN and CONTROL_CHARACTER_PATTERN filtering (lines 41-43, 84-87), and LogFormatUtils.formatValue() is applied throughout the codebase to sanitize user input before logging. Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T21:42:00.182839+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. not_affected \u2014 The target Spring Framework 6.2.5 is not affected by CVE-2021-22096 (log injection via malicious input containing newlines/control characters). The upstream vendor fix was already included in the Spring Framework 6.2.5 release that TuxCare onboarded. The fix consists of: (1) LogFormatUtils.formatValue() sanitizing logged strings by replacing newlines with <EOL> and control characters with ? (co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.2.5 is not affected by CVE-2021-22096 (log injection via malicious input containing newlines/control characters). The upstream vendor fix was already included in the Spring Framework 6.2.5 release that TuxCare onboarded. The fix consists of: (1) LogFormatUtils.formatValue() sanitizing logged strings by replacing newlines with <EOL> and control characters with ? (co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:18:58.233822+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 does not affect version 6.2.5-tuxcare.2 of org.springframework:spring-core. CVE-2024-22233 does not affect Spring Framework 6.2.5-tuxcare.4. The vulnerability affects versions 6.0.15 and 6.1.2, where HandlerMappingIntrospector incorrectly used String.matches() to compare URIs, treating them as regex patterns and causing PatternSyntaxException DoS with special characters. The target version 6.2.5 already contains the upstream fix (commit 7c9307e970) that replaced .matches() with .equals() at line 450 of HandlerMappingIntrospector.java. Additionally, ForwardedHeaderFilter contains the upstream fix (commit 4afac17e58) that wraps header parsing in try-catch to return HTTP 400 instead of propagating exceptions. Both fixes were authored by upstream Spring maintainer brian.clozel@broadcom.com and shipped in the upstream 6.2.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "impact_statement": "CVE-2024-22233 does not affect Spring Framework 6.2.5-tuxcare.4. The vulnerability affects versions 6.0.15 and 6.1.2, where HandlerMappingIntrospector incorrectly used String.matches() to compare URIs, treating them as regex patterns and causing PatternSyntaxException DoS with special characters. The target version 6.2.5 already contains the upstream fix (commit 7c9307e970) that replaced .matches() with .equals() at line 450 of HandlerMappingIntrospector.java. Additionally, ForwardedHeaderFilter contains the upstream fix (commit 4afac17e58) that wraps header parsing in try-catch to return HTTP 400 instead of propagating exceptions. Both fixes were authored by upstream Spring maintainer brian.clozel@broadcom.com and shipped in the upstream 6.2.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.2, < 6.1.3; >= 6.0.15, < 6.0.16), NVD (= 6.0.15; = 6.1.2), cve.org (= 6.1.2; = 6.0.15), Snyk (>= 6.0.15, < 6.0.16; >= 6.1.2, < 6.1.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.2.5-tuxcare.2 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    }
  ]
}