{
  "@id": "urn:uuid:77bb1883-42f2-4a41-8b54-9015a3997411",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:06:48.799530+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T20:58:33.259556+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Spring Security 6.4.3 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolons) to URLs. The fix (SEC-1584) was introduced in Spring Security 2.0.6 and 3.0.4 in October 2010 by upstream maintainer Luke Taylor. This fix is present in the upstream 6.4.3 release that TuxCare onboarded. The target implements comprehen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.3 is not affected by CVE-2010-3700. The vulnerability allowed attackers to bypass security constraints by adding path parameters (semicolons) to URLs. The fix (SEC-1584) was introduced in Spring Security 2.0.6 and 3.0.4 in October 2010 by upstream maintainer Luke Taylor. This fix is present in the upstream 6.4.3 release that TuxCare onboarded. The target implements comprehen..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T19:31:56.289601+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 The target Spring Security 6.4.3-tuxcare.11 is NOT affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager causing cross-thread privilege confusion via shared SecurityContext mutation) was fixed in upstream Spring Security 3.0.6 (2011) via commit 5fce0a58bd authored by luke.taylor@springsource.com. This fix shipped in the upstream 6.4.3 release that TuxCare onboarded (first...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 6.4.3-tuxcare.11 is NOT affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager causing cross-thread privilege confusion via shared SecurityContext mutation) was fixed in upstream Spring Security 3.0.6 (2011) via commit 5fce0a58bd authored by luke.taylor@springsource.com. This fix shipped in the upstream 6.4.3 release that TuxCare onboarded (first..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T23:06:48.799530+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 CVE-2011-2732 describes a CRLF injection vulnerability in Spring Security logout functionality via the spring-security-redirect parameter. The target repository (Spring Security 6.4.3) is NOT AFFECTED because the upstream vendor's fix was already present in the release that TuxCare onboarded. The fix (commit 824464516c by luke.taylor@springsource.com from 2011) added CRLF validation to Firewall...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 describes a CRLF injection vulnerability in Spring Security logout functionality via the spring-security-redirect parameter. The target repository (Spring Security 6.4.3) is NOT AFFECTED because the upstream vendor's fix was already present in the release that TuxCare onboarded. The fix (commit 824464516c by luke.taylor@springsource.com from 2011) added CRLF validation to Firewall..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T22:45:37.926257+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Spring Security 6.4.3 is NOT affected by CVE-2011-2894. The vulnerable RMI remoting module (containing ContextPropagatingRemoteInvocation.java) was completely removed by upstream Spring Security in commit b2e6c60d94 (2021-11-01). This removal occurred before TuxCare onboarded version 6.4.3, meaning the vulnerable code never existed in this target version. The entire spring-security-remoting mod...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.3 is NOT affected by CVE-2011-2894. The vulnerable RMI remoting module (containing ContextPropagatingRemoteInvocation.java) was completely removed by upstream Spring Security in commit b2e6c60d94 (2021-11-01). This removal occurred before TuxCare onboarded version 6.4.3, meaning the vulnerable code never existed in this target version. The entire spring-security-remoting mod..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T21:15:17.463976+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 The target repository (Spring Security 6.4.3) is not affected by CVE-2012-5055 (username enumeration via timing attack). The vulnerability was fixed in the upstream Spring Security project by commit c076f0f2e1 authored by Rob Winch (rwinch@vmware.com) from VMware. This fix was already present in Spring Security release 6.4.3 when TuxCare onboarded it (first TuxCare commit e168912832 comes 12,66...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 6.4.3) is not affected by CVE-2012-5055 (username enumeration via timing attack). The vulnerability was fixed in the upstream Spring Security project by commit c076f0f2e1 authored by Rob Winch (rwinch@vmware.com) from VMware. This fix was already present in Spring Security release 6.4.3 when TuxCare onboarded it (first TuxCare commit e168912832 comes 12,66..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Spring Security 6.4.3-tuxcare.4 is not affected by CVE-2018-1258. The vulnerability exists in Spring Framework 5.0.5's AspectJExpressionPointcut class, not in Spring Security's code. The target repository depends on Spring Framework 6.2.3, which is much newer than the vulnerable version and already contains the fix from Spring Framework 5.0.7.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.3-tuxcare.4 is not affected by CVE-2018-1258. The vulnerability exists in Spring Framework 5.0.5's AspectJExpressionPointcut class, not in Spring Security's code. The target repository depends on Spring Framework 6.2.3, which is much newer than the vulnerable version and already contains the fix from Spring Framework 5.0.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "action_statement": "Vulnerability CVE-2019-11272 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T22:07:50.682094+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Target Spring Security 6.4.3-tuxcare.11 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method was completely removed by upstream Spring Security in commit d996c2a2c6 (Sept 2022, part of 6.0.0 development), which predates TuxCare's onboarding of version 6.4.3. While the underlying AesBytesEncryptor class still contains a two-parameter constructor that uses a fixed ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 6.4.3-tuxcare.11 is NOT AFFECTED by CVE-2020-5408. The vulnerable `Encryptors.queryableText()` method was completely removed by upstream Spring Security in commit d996c2a2c6 (Sept 2022, part of 6.0.0 development), which predates TuxCare's onboarding of version 6.4.3. While the underlying AesBytesEncryptor class still contains a two-parameter constructor that uses a fixed ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T20:02:15.054048+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 CVE-2024-38827 addresses locale-dependent case conversion issues in String.toLowerCase() and String.toUpperCase() that could cause authorization bypass. The fix (adding explicit Locale.ROOT or Locale.ENGLISH arguments) was authored by upstream Spring Security maintainer Joe Grandja and shipped in the upstream 6.4.3 release. The target repository (Spring Security 6.4.3-tuxcare.11) inherited this...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38827 addresses locale-dependent case conversion issues in String.toLowerCase() and String.toUpperCase() that could cause authorization bypass. The fix (adding explicit Locale.ROOT or Locale.ENGLISH arguments) was authored by upstream Spring Security maintainer Joe Grandja and shipped in the upstream 6.4.3 release. The target repository (Spring Security 6.4.3-tuxcare.11) inherited this..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2025-22228"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "action_statement": "Vulnerability CVE-2025-41232 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2025-41248"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 is fixed in version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core.",
      "vulnerability": {
        "name": "CVE-2026-22751"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-15T11:34:00.137653+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core, and is fixed in 6.4.3-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      },
      "action_statement": "Vulnerability CVE-2026-47842 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core, and is fixed in 6.4.3-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-15T11:34:00.137653+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core, and is fixed in 6.4.3-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core, and is fixed in 6.4.3-tuxcare.10."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-core@6.4.3-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.4.3-tuxcare.5 of org.springframework.security:spring-security-oauth2-core. not_affected \u2014 Spring Security 6.4.3 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class (with matchInternal() and matchExternal() builders) was introduced in Spring Security 7.1 and does not exist in version 6.4.3. The target has IpAddressMatcher (a different class for CIDR pattern matching) but no code that classifies IP addresses as internal/external for access control purposes.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.3 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class (with matchInternal() and matchExternal() builders) was introduced in Spring Security 7.1 and does not exist in version 6.4.3. The target has IpAddressMatcher (a different class for CIDR pattern matching) but no code that classifies IP addresses as internal/external for access control purposes."
    }
  ]
}