{
  "@id": "urn:uuid:22677f9d-9423-44c6-a22e-085a15f67cde",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 26,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:05:47.086442+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. already_fixed \u2014 The target repository already contains the fix for CVE-2007-1651. The upstream patch commit f5468087c2 (April 15, 2010) that removes cached DiscoveryInformation from session is present in the target's git history, plus additional security enhancements from commit 89fa771093 (July 13, 2011) that add null checking and ATTRIBUTE_LIST_KEY removal.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "already_fixed \u2014 The target repository already contains the fix for CVE-2007-1651. The upstream patch commit f5468087c2 (April 15, 2010) that removes cached DiscoveryInformation from session is present in the target's git history, plus additional security enhancements from commit 89fa771093 (July 13, 2011) that add null checking and ATTRIBUTE_LIST_KEY removal."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. already_fixed \u2014 The target repository (spring-security 5.7.11.tuxcare) already contains the security fixes for CVE-2007-1652. Both defensive measures from the upstream patches are present: (1) null check rejecting requests with missing DiscoveryInformation at lines 141-144, and (2) immediate session token removal at lines 149-150. These fixes were merged via upstream commits f5468087c2 (April 2010) and 89fa771...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "already_fixed \u2014 The target repository (spring-security 5.7.11.tuxcare) already contains the security fixes for CVE-2007-1652. Both defensive measures from the upstream patches are present: (1) null check rejecting requests with missing DiscoveryInformation at lines 141-144, and (2) immediate session token removal at lines 149-150. These fixes were merged via upstream commits f5468087c2 (April 2010) and 89fa771..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T20:56:39.821004+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Target version 4.2.12.RELEASE contains the upstream vendor fix for CVE-2010-3700. The vulnerability allowed bypassing security constraints by adding path parameters (semicolon-delimited segments) to URLs. Spring Security fixed this in versions 2.0.6 and 3.0.4 (Oct 2010) by introducing the HttpFirewall mechanism that strips/rejects path parameters before security pattern matching. Version 4.2.12...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Target version 4.2.12.RELEASE contains the upstream vendor fix for CVE-2010-3700. The vulnerability allowed bypassing security constraints by adding path parameters (semicolon-delimited segments) to URLs. Spring Security fixed this in versions 2.0.6 and 3.0.4 (Oct 2010) by introducing the HttpFirewall mechanism that strips/rejects path parameters before security pattern matching. Version 4.2.12..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:28:54.255209+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 CVE-2011-2731 is NOT AFFECTED in Spring Security 4.2.12.RELEASE. The vulnerable pattern (RunAsManager storing Authentication in a shared SecurityContext, allowing privilege escalation via race conditions) was fixed by upstream Spring Security developers in 2011-2012 (SEC-1750 and SEC-1967). The fix was already present in the upstream 4.2.12.RELEASE that TuxCare onboarded. The target code correc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 is NOT AFFECTED in Spring Security 4.2.12.RELEASE. The vulnerable pattern (RunAsManager storing Authentication in a shared SecurityContext, allowing privilege escalation via race conditions) was fixed by upstream Spring Security developers in 2011-2012 (SEC-1750 and SEC-1967). The fix was already present in the upstream 4.2.12.RELEASE that TuxCare onboarded. The target code correc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T23:05:47.086442+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout functionality) is NOT present in Spring Security 4.2.12.RELEASE. The target contains comprehensive defenses against this vulnerability that were already shipped in the upstream release before TuxCare onboarded it. Defense #1: FirewalledResponse validates all redirect locations for CR/LF characters (Pattern.compile(\"\\\\r|\\\\n\")) and throws IllegalArgumentExc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout functionality) is NOT present in Spring Security 4.2.12.RELEASE. The target contains comprehensive defenses against this vulnerability that were already shipped in the upstream release before TuxCare onboarded it. Defense #1: FirewalledResponse validates all redirect locations for CR/LF characters (Pattern.compile(\"\\\\r|\\\\n\")) and throws IllegalArgumentExc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:45:22.602531+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 CVE-2011-2894 affects Spring Security 3.0.0-3.0.5 and 2.0.0-2.0.6 via unsafe deserialization of SecurityContext objects in RMI remote invocations. The target version 4.2.12.RELEASE is NOT vulnerable because the upstream vendor (Spring Security project) fixed this vulnerability in version 3.0.6.RELEASE (May 2011, commit ba719dc0e1 by luke.taylor@springsource.com). The fix replaced SecurityContex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security 3.0.0-3.0.5 and 2.0.0-2.0.6 via unsafe deserialization of SecurityContext objects in RMI remote invocations. The target version 4.2.12.RELEASE is NOT vulnerable because the upstream vendor (Spring Security project) fixed this vulnerability in version 3.0.6.RELEASE (May 2011, commit ba719dc0e1 by luke.taylor@springsource.com). The fix replaced SecurityContex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:16:17.754543+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 CVE-2012-5055 (username enumeration via timing attack) is not present in Spring Security 4.2.12.RELEASE. The upstream vendor fix (commit c076f0f2e1 by Rob Winch/VMware, applied September 2012) was already included in the 4.2.12.RELEASE that TuxCare onboarded. The fix performs password validation against a pre-computed dummy password even when a user is not found (DaoAuthenticationProvider.java ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (username enumeration via timing attack) is not present in Spring Security 4.2.12.RELEASE. The upstream vendor fix (commit c076f0f2e1 by Rob Winch/VMware, applied September 2012) was already included in the 4.2.12.RELEASE that TuxCare onboarded. The fix performs password validation against a pre-computed dummy password even when a user is not found (DaoAuthenticationProvider.java ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "action_statement": "Vulnerability CVE-2018-1258 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. already_fixed \u2014 CVE-2019-3795 is already fixed in Spring Security 4.2.12.RELEASE. The target version contains the security patch (commit 6f02f690ac6, March 2019) that prevents insecure randomness by forcing SecureRandom auto-seeding before applying custom seeds.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "already_fixed \u2014 CVE-2019-3795 is already fixed in Spring Security 4.2.12.RELEASE. The target version contains the security patch (commit 6f02f690ac6, March 2019) that prevents insecure randomness by forcing SecureRandom auto-seeding before applying custom seeds."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "action_statement": "Vulnerability CVE-2020-5408 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:18:37.843029+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 4.2.12.RELEASE is NOT affected by CVE-2025-22223. The vulnerability exists only in Spring Security 5.6+ where the new @EnableMethodSecurity API and UniqueSecurityAnnotationScanner class were introduced. This version uses the older @EnableGlobalMethodSecurity API with AnnotationUtils.findAnnotation() which correctly handles generic type resolution through Spring Framework's bridg...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 4.2.12.RELEASE is NOT affected by CVE-2025-22223. The vulnerability exists only in Spring Security 5.6+ where the new @EnableMethodSecurity API and UniqueSecurityAnnotationScanner class were introduced. This version uses the older @EnableGlobalMethodSecurity API with AnnotationUtils.findAnnotation() which correctly handles generic type resolution through Spring Framework's bridg..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:45:04.635215+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 4.2.12.RELEASE does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 4.2.12.RELEASE does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T11:34:00.087002+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 4.2.12.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 4.2.12.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      },
      "action_statement": "Vulnerability CVE-2026-22746 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 4.2.12.RELEASE is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token authentication feature do not exist in this version. The feature was introduced in Spring Security 6.4.0, which is 2+ major versions ahead of the target. No code path exists to process one-time token authentication requests. This is a Type A1 case wh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 4.2.12.RELEASE is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token authentication feature do not exist in this version. The feature was introduced in Spring Security 6.4.0, which is 2+ major versions ahead of the target. No code path exists to process one-time token authentication requests. This is a Type A1 case wh..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41003 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. Spring Security 4.2.12.RELEASE is outside the CVE-2026-41003 affected ranges, which begin at 5.7.0, and does not contain the vulnerable SAML2 service-provider implementation.",
      "vulnerability": {
        "name": "CVE-2026-41003"
      },
      "impact_statement": "Spring Security 4.2.12.RELEASE is outside the CVE-2026-41003 affected ranges, which begin at 5.7.0, and does not contain the vulnerable SAML2 service-provider implementation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-13T10:54:00.087057+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-aspects@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 4.2.12.RELEASE does not contain the InetAddressMatchers utility class that is vulnerable in this CVE. The feature (matchInternal/matchExternal builders for IP address classification) was introduced in a much later version of Spring Security. The target version predates this functionality entirely, making it not affected by CVE-2026-59277.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 4.2.12.RELEASE does not contain the InetAddressMatchers utility class that is vulnerable in this CVE. The feature (matchInternal/matchExternal builders for IP address classification) was introduced in a much later version of Spring Security. The target version predates this functionality entirely, making it not affected by CVE-2026-59277."
    }
  ]
}