{
  "@id": "urn:uuid:e78539b1-cfb7-46dd-9887-70658fb95f53",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 30,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:09:39.867220+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T20:59:31.949589+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints by adding path parameters (e.g., `/admin.html;x=user.html`) to URLs. The target repository is Spring Security 6.5.11-tuxcare.4, which contains the upstream fix (SEC-1584, commit 7d97adc687) authored by Luke Taylor. The fix introduces HttpFirewall infrastructure with Req...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints by adding path parameters (e.g., `/admin.html;x=user.html`) to URLs. The target repository is Spring Security 6.5.11-tuxcare.4, which contains the upstream fix (SEC-1584, commit 7d97adc687) authored by Luke Taylor. The fix introduces HttpFirewall infrastructure with Req..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T19:31:56.289601+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager allowing privilege escalation via shared SecurityContext) was fixed in upstream Spring Security versions 2.0.7 and 3.0.6 (released 2011-2012). The target contains the complete fix, which was already present in the upstream 6.5.11 release before TuxCare onboarded it. The vulnerable pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager allowing privilege escalation via shared SecurityContext) was fixed in upstream Spring Security versions 2.0.7 and 3.0.6 (released 2011-2012). The target contains the complete fix, which was already present in the upstream 6.5.11 release before TuxCare onboarded it. The vulnerable pattern ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T23:09:39.867220+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 CVE-2011-2732 is not present in Spring Security 6.5.11. Both required defenses are present: (1) CR/LF validation in FirewalledResponse.sendRedirect() blocks malicious redirect locations, and (2) targetUrlParameter defaults to null in the parent class AbstractAuthenticationTargetUrlRequestHandler, preventing the spring-security-redirect parameter from being read. Both defenses originated from up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 is not present in Spring Security 6.5.11. Both required defenses are present: (1) CR/LF validation in FirewalledResponse.sendRedirect() blocks malicious redirect locations, and (2) targetUrlParameter defaults to null in the parent class AbstractAuthenticationTargetUrlRequestHandler, preventing the spring-security-redirect parameter from being read. Both defenses originated from up..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T22:48:08.143939+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 The target Spring Security 6.5.11 is not affected by CVE-2011-2894. The vulnerable code (ContextPropagatingRemoteInvocation class and the entire spring-security-remoting module) was removed by upstream Spring Security in October 2021 (commit b2e6c60d94, included in version 6.0.0). The removal was part of the upstream release that TuxCare later onboarded. The target does not receive or process t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.5.11 is not affected by CVE-2011-2894. The vulnerable code (ContextPropagatingRemoteInvocation class and the entire spring-security-remoting module) was removed by upstream Spring Security in October 2021 (commit b2e6c60d94, included in version 6.0.0). The removal was part of the upstream release that TuxCare later onboarded. The target does not receive or process t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T21:17:59.994008+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2012-5055. The timing attack vulnerability in DaoAuthenticationProvider was fixed in upstream Spring Security (commit c076f0f2e1 by Rob Winch @vmware.com) long before this version. The fix was already present in the Spring Security 6.5.11 release that TuxCare onboarded. The current code includes complete timing attack mitigation: when a user is not ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11 is not affected by CVE-2012-5055. The timing attack vulnerability in DaoAuthenticationProvider was fixed in upstream Spring Security (commit c076f0f2e1 by Rob Winch @vmware.com) long before this version. The fix was already present in the Spring Security 6.5.11 release that TuxCare onboarded. The current code includes complete timing attack mitigation: when a user is not ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "action_statement": "Vulnerability CVE-2019-11272 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T22:07:50.682094+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 CVE-2020-5408 affects Spring Security's queryableText() encryptor method which used a fixed null initialization vector with CBC mode, enabling dictionary attacks. The target repository at version 6.5.11 is NOT AFFECTED because the vulnerable queryableText() method was completely removed from the codebase in upstream commit d996c2a2c6 (September 2022) by Rob Winch. This removal was already prese...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects Spring Security's queryableText() encryptor method which used a fixed null initialization vector with CBC mode, enabling dictionary attacks. The target repository at version 6.5.11 is NOT AFFECTED because the vulnerable queryableText() method was completely removed from the codebase in upstream commit d996c2a2c6 (September 2022) by Rob Winch. This removal was already prese..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T20:02:15.054048+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2024-38827. The vulnerability involves locale-dependent string case transformations in authorization code that could bypass security rules. However, the upstream Spring Security team already fixed this issue in version 6.5.11 (commit a7bf8f7cc68d95ce30f18722f5d441ea3fa798f4 by Joe Grandja) before TuxCare onboarded the version. All producti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2024-38827. The vulnerability involves locale-dependent string case transformations in authorization code that could bypass security rules. However, the upstream Spring Security team already fixed this issue in version 6.5.11 (commit a7bf8f7cc68d95ce30f18722f5d441ea3fa798f4 by Joe Grandja) before TuxCare onboarded the version. All producti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:18:37.843029+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2025-22223. The vulnerability (method security annotations not being located on parameterized types/methods) was fixed by upstream Spring Security in commit dc2e1af2dab8ef81cd4edd25b56a2babeaab8cf9 (authored by Josh Cummings on 2025-01-08). This fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2025-22223. The vulnerability (method security annotations not being located on parameterized types/methods) was fixed by upstream Spring Security in commit dc2e1af2dab8ef81cd4edd25b56a2babeaab8cf9 (authored by Josh Cummings on 2025-01-08). This fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:32:37.090382+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2025-22228"
      },
      "action_statement": "Vulnerability CVE-2025-22228 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 CVE-2025-22234 is not present in spring-security 6.5.11-tuxcare.4. The vulnerability (timing attack side channel in DaoAuthenticationProvider due to CVE-2025-22228's 72-byte password limit) was fixed by upstream Spring Security maintainer Joe Grandja in commit c1aa99fdd21 (April 17, 2025), which was already included in the upstream 6.5.11 release that TuxCare onboarded. The fix adds a `for_chec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 is not present in spring-security 6.5.11-tuxcare.4. The vulnerability (timing attack side channel in DaoAuthenticationProvider due to CVE-2025-22228's 72-byte password limit) was fixed by upstream Spring Security maintainer Joe Grandja in commit c1aa99fdd21 (April 17, 2025), which was already included in the upstream 6.5.11 release that TuxCare onboarded. The fix adds a `for_chec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T10:52:09.988158+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. Spring Security 6.5.11 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.5.11 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T11:37:35.533056+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. Spring Security 6.5.11 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 6.5.11 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T12:28:47.949005+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22746. The timing attack defense was implemented via commit a317a3d8663995daa2bc91593bb88ae2da21ea52 (April 15, 2026), which ensures constant-time authentication by always executing password verification even when account state checks fail.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22746"
      },
      "impact_statement": "already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22746. The timing attack defense was implemented via commit a317a3d8663995daa2bc91593bb88ae2da21ea52 (April 15, 2026), which ensures constant-time authentication by always executing password verification even when account state checks fail."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 The target repository (Spring Security 6.5.11-tuxcare.4) is not affected by CVE-2026-22751. The TOCTOU race condition vulnerability in JdbcOneTimeTokenService was already fixed in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The vulnerable code pattern (SELECT without verifying DELETE succeeded) is not present in the target. The fix verifies that the DELETE operation remo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 6.5.11-tuxcare.4) is not affected by CVE-2026-22751. The TOCTOU race condition vulnerability in JdbcOneTimeTokenService was already fixed in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The vulnerable code pattern (SELECT without verifying DELETE succeeded) is not present in the target. The fix verifies that the DELETE operation remo..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T12:33:23.004157+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 is fixed in version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T12:33:23.004157+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-data@6.5.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() builders was introduced in Spring Security 7.1, but the target version is 6.5.11. The entire affected class does not exist in this version, so the vulnerability pattern cannot be present. This is a Type A1 case where the vulnerable code was not yet in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() builders was introduced in Spring Security 7.1, but the target version is 6.5.11. The entire affected class does not exist in this version, so the vulnerability pattern cannot be present. This is a Type A1 case where the vulnerable code was not yet in..."
    }
  ]
}