{
  "@id": "urn:uuid:a51f2262-4ff5-4cbd-b9b5-7421491be51d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:05:47.086442+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T20:56:39.821004+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2010-3700 (path parameter bypass). The vulnerability allowed attackers to bypass security constraints by adding semicolon-delimited path parameters (e.g., /secured;x=y/admin.html) to URLs. The target contains TWO upstream defenses: (1) StrictHttpFirewall (default since ~2016) REJECTS requests containing semicolons (lines 96-97, 146 in StrictHttpFire...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2010-3700 (path parameter bypass). The vulnerability allowed attackers to bypass security constraints by adding semicolon-delimited path parameters (e.g., /secured;x=y/admin.html) to URLs. The target contains TWO upstream defenses: (1) StrictHttpFirewall (default since ~2016) REJECTS requests containing semicolons (lines 96-97, 146 in StrictHttpFire..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T19:27:56.776788+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 6.3.10. The vulnerability (race condition allowing privilege escalation via shared SecurityContext in RunAsManager) was fixed by upstream commits SEC-1750 (thread isolation) and SEC-1967 (finally block restoration), both authored by SpringSource/VMware developers and shipped in the upstream release before TuxCare work began. All interceptor implem...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 6.3.10. The vulnerability (race condition allowing privilege escalation via shared SecurityContext in RunAsManager) was fixed by upstream commits SEC-1750 (thread isolation) and SEC-1967 (finally block restoration), both authored by SpringSource/VMware developers and shipped in the upstream release before TuxCare work began. All interceptor implem..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T23:05:47.086442+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 6.3.10. Both defenses from the 2011 SEC-1790 security patches are present in the target: (1) FirewalledResponse validates and rejects redirect locations containing CR/LF characters before passing to sendRedirect(), and (2) targetUrlParameter defaults to null, preventing reading attacker-controlled redirect URLs from request parameters. These fixes...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 is NOT present in Spring Security 6.3.10. Both defenses from the 2011 SEC-1790 security patches are present in the target: (1) FirewalledResponse validates and rejects redirect locations containing CR/LF characters before passing to sendRedirect(), and (2) targetUrlParameter defaults to null, preventing reading attacker-controlled redirect URLs from request parameters. These fixes..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T22:45:57.313988+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Target Spring Security 6.3.10 is NOT AFFECTED by CVE-2011-2894. The vulnerable code (ContextPropagatingRemoteInvocation class in the remoting/rmi package) does not exist in this version because the entire spring-security-remoting module was removed by upstream Spring Security in version 6.0.0-M1 (October 2021), before TuxCare onboarded version 6.3.10 (April 2026). The vulnerability involved des...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 6.3.10 is NOT AFFECTED by CVE-2011-2894. The vulnerable code (ContextPropagatingRemoteInvocation class in the remoting/rmi package) does not exist in this version because the entire spring-security-remoting module was removed by upstream Spring Security in version 6.0.0-M1 (October 2021), before TuxCare onboarded version 6.3.10 (April 2026). The vulnerability involved des..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T21:15:17.463976+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 CVE-2012-5055 describes a timing attack vulnerability in DaoAuthenticationProvider where password validation is skipped when a user is not found, allowing username enumeration. The target Spring Security 6.3.10 contains the upstream fix (commit c076f0f2e1, authored by Rob Winch from VMware in September 2012) which was part of the original release that TuxCare onboarded. The fix introduces the m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 describes a timing attack vulnerability in DaoAuthenticationProvider where password validation is skipped when a user is not found, allowing username enumeration. The target Spring Security 6.3.10 contains the upstream fix (commit c076f0f2e1, authored by Rob Winch from VMware in September 2012) which was part of the original release that TuxCare onboarded. The fix introduces the m..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "action_statement": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T22:06:08.597138+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 The target Spring Security version 6.3.10 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that used a fixed null initialization vector with AES-CBC mode does not exist in the target codebase. This method was completely removed by upstream Spring Security in commit d996c2a2c6 (September 2022) before TuxCare onboarded version 6.3.10. All remaining public encry...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security version 6.3.10 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method that used a fixed null initialization vector with AES-CBC mode does not exist in the target codebase. This method was completely removed by upstream Spring Security in commit d996c2a2c6 (September 2022) before TuxCare onboarded version 6.3.10. All remaining public encry..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T20:00:47.750212+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.21 is NOT AFFECTED by CVE-2024-38827. The vulnerability (locale-dependent case conversion in authorization-critical string processing) was fixed in the upstream Spring Security 6.3.10 release before TuxCare onboarded it. All production code now uses explicit Locale arguments (Locale.ROOT or Locale.ENGLISH) with toLowerCase() and toUpperCase() methods, p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.3.10-tuxcare.21 is NOT AFFECTED by CVE-2024-38827. The vulnerability (locale-dependent case conversion in authorization-critical string processing) was fixed in the upstream Spring Security 6.3.10 release before TuxCare onboarded it. All production code now uses explicit Locale arguments (Locale.ROOT or Locale.ENGLISH) with toLowerCase() and toUpperCase() methods, p..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T18:34:10.986929+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "action_statement": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T18:32:37.090382+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2025-22228"
      },
      "action_statement": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-30T10:49:55.998641+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-28T18:34:10.986929+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "action_statement": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-15T12:46:01.751461+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core, and is fixed in 6.3.10-tuxcare.20.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      },
      "action_statement": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core, and is fixed in 6.3.10-tuxcare.20."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-15T12:46:01.751461+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core, and is fixed in 6.3.10-tuxcare.20.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core, and is fixed in 6.3.10-tuxcare.20."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.3.10-tuxcare.11"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.11 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6...."
    }
  ]
}