{
  "@id": "urn:uuid:36c6c76f-4ea6-45bf-adb5-6d91e58f869e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:00:22.873954+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T20:51:00.153763+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolon-delimited segments) to URLs. The upstream fix (SEC-1584, commit 7d97adc68789f4a191cee15de482530dd9d5c31d by Luke Taylor, October 2010) introduced HttpFirewall infrastructure that strips path parameters before security pattern matching. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolon-delimited segments) to URLs. The upstream fix (SEC-1584, commit 7d97adc68789f4a191cee15de482530dd9d5c31d by Luke Taylor, October 2010) introduced HttpFirewall infrastructure that strips path parameters before security pattern matching. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T19:22:00.172401+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target repository (Spring Security 6.2.7-tuxcare.8) is not affected because the vulnerability was fixed in upstream Spring Security releases from 2011-2012 (SEC-1750, SEC-1967), well before version 6.2.7. The fix creates an isolated SecurityContext for RunAs authentication instead of modifying the shared context, pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target repository (Spring Security 6.2.7-tuxcare.8) is not affected because the vulnerability was fixed in upstream Spring Security releases from 2011-2012 (SEC-1750, SEC-1967), well before version 6.2.7. The fix creates an isolated SecurityContext for RunAs authentication instead of modifying the shared context, pre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T23:00:22.873954+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.7 is NOT affected by CVE-2011-2732. The vulnerability (CRLF injection in logout redirect functionality) was fixed by the upstream Spring Security project in 2011 via commit 824464516c (SEC-1790). The fix was already present in the upstream 6.2.7 release that TuxCare onboarded. All defensive measures are functional: (1) FirewalledResponse validates and rejects redirect URLs c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.7 is NOT affected by CVE-2011-2732. The vulnerability (CRLF injection in logout redirect functionality) was fixed by the upstream Spring Security project in 2011 via commit 824464516c (SEC-1790). The fix was already present in the upstream 6.2.7 release that TuxCare onboarded. All defensive measures are functional: (1) FirewalledResponse validates and rejects redirect URLs c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T22:41:16.546891+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 affects Spring Security 2.0.0-2.0.6 and 3.0.0-3.0.5 via deserialization of SecurityContext objects in RMI remoting (ContextPropagatingRemoteInvocation). The target version 6.2.7 is not affected because the entire spring-security-remoting module was removed by upstream Spring Security in October 2021 (commit b2e6c60d94), shipping in version 6.0.0+. The vulnerable code does not exis...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security 2.0.0-2.0.6 and 3.0.0-3.0.5 via deserialization of SecurityContext objects in RMI remoting (ContextPropagatingRemoteInvocation). The target version 6.2.7 is not affected because the entire spring-security-remoting module was removed by upstream Spring Security in October 2021 (commit b2e6c60d94), shipping in version 6.0.0+. The vulnerable code does not exis..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T21:11:12.927650+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 6.2.7-tuxcare.8. The vulnerability (timing side-channel allowing username enumeration via password encoding only occurring when user exists) was fixed by upstream Spring Security in commit c076f0f2e1 authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream 6.2.7 release that TuxCare onboarded. The target code impleme...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 6.2.7-tuxcare.8. The vulnerability (timing side-channel allowing username enumeration via password encoding only occurring when user exists) was fixed by upstream Spring Security in commit c076f0f2e1 authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream 6.2.7 release that TuxCare onboarded. The target code impleme..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "action_statement": "Vulnerability CVE-2019-11272 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T22:02:33.258307+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 6.2.7 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that created text encryptors using a fixed null initialization vector with CBC mode was completely removed from the codebase by upstream commit d996c2a2c in September 2022 (author: Rob Winch <rwinch@users.noreply.github.com>). This removal occurred before TuxCare onboarded version 6...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 6.2.7 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that created text encryptors using a fixed null initialization vector with CBC mode was completely removed from the codebase by upstream commit d996c2a2c in September 2022 (author: Rob Winch <rwinch@users.noreply.github.com>). This removal occurred before TuxCare onboarded version 6..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T14:26:25.287433+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:34:10.986929+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "action_statement": "Vulnerability CVE-2025-22223 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T14:26:25.287433+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 is fixed in version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22228"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T14:26:25.287433+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T10:49:55.998641+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. Spring Security 6.2.7 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.2.7 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:34:10.986929+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "action_statement": "Vulnerability CVE-2025-41248 affects version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T14:26:25.287433+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security version 6.2.7-tuxcare.8 does not contain the vulnerable JdbcOneTimeTokenService component or the OneTimeToken authentication feature at all. This feature was introduced in upstream Spring Security version 6.4.0, which postdates the target version. The vulnerability cannot manifest because the code that implements one-time token authentication does not exist in this ve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security version 6.2.7-tuxcare.8 does not contain the vulnerable JdbcOneTimeTokenService component or the OneTimeToken authentication feature at all. This feature was introduced in upstream Spring Security version 6.4.0, which postdates the target version. The vulnerability cannot manifest because the code that implements one-time token authentication does not exist in this ve..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T14:28:00.747532+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 is fixed in version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T14:28:00.747532+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-59277. The vulnerable component `InetAddressMatchers` with `matchInternal()` and `matchExternal()` builders was introduced in Spring Security 7.1 (February 2026), well after version 6.2.7 was released. The class literally does not exist in the target codebase. While 6.2.7 contains an older `IpAddressMatcher` class for CIDR-based matching, it doe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-59277. The vulnerable component `InetAddressMatchers` with `matchInternal()` and `matchExternal()` builders was introduced in Spring Security 7.1 (February 2026), well after version 6.2.7 was released. The class literally does not exist in the target codebase. While 6.2.7 contains an older `IpAddressMatcher` class for CIDR-based matching, it doe..."
    }
  ]
}