{
  "@id": "urn:uuid:38043ded-3573-4e2e-be2d-eb3aa7d25726",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:02:53.904310+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.14-tuxcare.7. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.14-tuxcare.7. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T20:54:01.505024+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 CVE-2010-3700 (path parameter security bypass) is NOT present in Spring Security 5.7.14. The vulnerability allowed attackers to bypass security constraints by adding path parameters (e.g., `/secured;x=y/admin.html`) to URLs. The fix (SEC-1584) was applied by upstream Spring Security in October 2010 for version 3.0.4, introducing HttpFirewall with RequestWrapper to strip path parameters before s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 (path parameter security bypass) is NOT present in Spring Security 5.7.14. The vulnerability allowed attackers to bypass security constraints by adding path parameters (e.g., `/secured;x=y/admin.html`) to URLs. The fix (SEC-1584) was applied by upstream Spring Security in October 2010 for version 3.0.4, introducing HttpFirewall with RequestWrapper to strip path parameters before s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T19:25:00.123960+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 CVE-2011-2731 describes a race condition in Spring Security's RunAsManager mechanism where multiple threads could share the same SecurityContext object, leading to privilege escalation. The target repository (Spring Security 5.7.14-tuxcare.10) is NOT AFFECTED because the upstream fixes (SEC-1750 and SEC-1967) were already present in the Spring Security 5.7.14 release that TuxCare onboarded. The...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 describes a race condition in Spring Security's RunAsManager mechanism where multiple threads could share the same SecurityContext object, leading to privilege escalation. The target repository (Spring Security 5.7.14-tuxcare.10) is NOT AFFECTED because the upstream fixes (SEC-1750 and SEC-1967) were already present in the Spring Security 5.7.14 release that TuxCare onboarded. The..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T23:02:53.904310+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 The target repository (Spring Security 5.7.14-tuxcare.10) is not affected by CVE-2011-2732. The CRLF injection vulnerability in logout redirect handling was fixed in upstream Spring Security in 2011 (commit 824464516ceb by Luke Taylor) and is present in the 5.7.14 release that TuxCare onboarded. The FirewalledResponse class wraps all HTTP responses and validates redirect locations, rejecting an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Security 5.7.14-tuxcare.10) is not affected by CVE-2011-2732. The CRLF injection vulnerability in logout redirect handling was fixed in upstream Spring Security in 2011 (commit 824464516ceb by Luke Taylor) and is present in the 5.7.14 release that TuxCare onboarded. The FirewalledResponse class wraps all HTTP responses and validates redirect locations, rejecting an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T22:41:16.546891+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 The target Spring Security 5.7.14-tuxcare.10 is NOT AFFECTED by CVE-2011-2894. The deserialization vulnerability was fixed upstream by Luke Taylor in May 2011 (commit b48fc53fa2) and the fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The vulnerable pattern (serializing entire SecurityContext objects via RMI) has been replaced with a safe pattern (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.7.14-tuxcare.10 is NOT AFFECTED by CVE-2011-2894. The deserialization vulnerability was fixed upstream by Luke Taylor in May 2011 (commit b48fc53fa2) and the fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The vulnerable pattern (serializing entire SecurityContext objects via RMI) has been replaced with a safe pattern (..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T21:14:20.175704+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 CVE-2012-5055 describes a timing attack vulnerability in DaoAuthenticationProvider that allows username enumeration. The target Spring Security 5.7.14-tuxcare.10 contains the complete SEC-2056 fix including timing attack mitigation methods (prepareTimingAttackProtection, mitigateAgainstTimingAttack) that ensure password validation occurs even when a user is not found. The fix was authored by up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 describes a timing attack vulnerability in DaoAuthenticationProvider that allows username enumeration. The target Spring Security 5.7.14-tuxcare.10 contains the complete SEC-2056 fix including timing attack mitigation methods (prepareTimingAttackProtection, mitigateAgainstTimingAttack) that ensure password validation occurs even when a user is not found. The fix was authored by up..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. already_fixed \u2014 Spring Security 5.7.14-tuxcare.2 depends on Spring Framework 5.3.29-tuxcare.4, which contains the fix for CVE-2018-1258 that was introduced in Spring Framework 5.0.7. The vulnerability involved synthetic methods bypassing method-level security annotations due to missing filtering in ReflectionUtils.USER_DECLARED_METHODS. The target's dependency version is 23 minor versions beyond the fixed vers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "already_fixed \u2014 Spring Security 5.7.14-tuxcare.2 depends on Spring Framework 5.3.29-tuxcare.4, which contains the fix for CVE-2018-1258 that was introduced in Spring Framework 5.0.7. The vulnerability involved synthetic methods bypassing method-level security annotations due to missing filtering in ReflectionUtils.USER_DECLARED_METHODS. The target's dependency version is 23 minor versions beyond the fixed vers..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "action_statement": "Vulnerability CVE-2019-11272 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T22:03:47.730298+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 CVE-2020-5408 is NOT present in Spring Security 5.7.14. The vulnerability involves using a fixed null initialization vector with CBC mode in the queryableText() encryptor, enabling dictionary attacks. The vendor's fix (deprecation of queryableText() with security warning) was already included in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The vulnerable pattern (unwarned...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 is NOT present in Spring Security 5.7.14. The vulnerability involves using a fixed null initialization vector with CBC mode in the queryableText() encryptor, enabling dictionary attacks. The vendor's fix (deprecation of queryableText() with security warning) was already included in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The vulnerable pattern (unwarned..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T19:59:27.093399+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 CVE-2024-38827 affects Spring Security versions that use toLowerCase/toUpperCase without explicit Locale arguments in authorization code, potentially causing authorization bypass via locale-specific character transformations (e.g., Turkish 'i'/'I'). The target (Spring Security 5.7.14-tuxcare.10) is NOT AFFECTED because the fix was already included in the upstream 5.7.14 release on 2024-11-18. C...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38827 affects Spring Security versions that use toLowerCase/toUpperCase without explicit Locale arguments in authorization code, potentially causing authorization bypass via locale-specific character transformations (e.g., Turkish 'i'/'I'). The target (Spring Security 5.7.14-tuxcare.10) is NOT AFFECTED because the fix was already included in the upstream 5.7.14 release on 2024-11-18. C..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:34:10.986929+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "action_statement": "Vulnerability CVE-2025-22223 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 is fixed in version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2025-22228"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T10:48:29.606694+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.14 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.14 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T11:36:43.630807+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. Spring Security 5.7.14 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 5.7.14 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2026-22748 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.14-tuxcare.7. direct vulnerability is in Spring Security project - affected versions are spring-security-oauth2-jose 6.3.0-6.3.14 / 6.4.0-6.4.14 / 6.5.0-6.5.9 / 7.0.0-7.0.4, version 5.7.14 is not in this range",
      "vulnerability": {
        "name": "CVE-2026-22748"
      },
      "impact_statement": "direct vulnerability is in Spring Security project - affected versions are spring-security-oauth2-jose 6.3.0-6.3.14 / 6.4.0-6.4.14 / 6.5.0-6.5.9 / 7.0.0-7.0.4, version 5.7.14 is not in this range"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.14 is not affected by CVE-2026-22751. The vulnerable component `JdbcOneTimeTokenService` does not exist in this version. The one-time token authentication feature was introduced in Spring Security 6.4.0, which is significantly later than version 5.7.14. Exhaustive searches confirmed no OneTimeToken classes, interfaces, or related code exist in the target repository at HEAD (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.14 is not affected by CVE-2026-22751. The vulnerable component `JdbcOneTimeTokenService` does not exist in this version. The one-time token authentication feature was introduced in Spring Security 6.4.0, which is significantly later than version 5.7.14. Exhaustive searches confirmed no OneTimeToken classes, interfaces, or related code exist in the target repository at HEAD (..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T11:44:48.822715+00:00",
      "status_notes": "Vulnerability CVE-2026-41707 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.7.14 contains no DPoP code, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41707"
      },
      "impact_statement": "CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.7.14 contains no DPoP code, so it is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T17:28:00.089399+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 5.7.14-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      },
      "action_statement": "Vulnerability CVE-2026-47842 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 5.7.14-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-15T17:28:00.089399+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 5.7.14-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 5.7.14-tuxcare.8."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.7.14-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.14 is not affected by CVE-2026-59277. The vulnerable component, `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` builder methods, does not exist in this version. The CVE concerns a feature introduced in a later version of Spring Security where the internal/external IP address classification failed to recognize IPv4/IPv6 \"any local\" address...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.7.14 is not affected by CVE-2026-59277. The vulnerable component, `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` builder methods, does not exist in this version. The CVE concerns a feature introduced in a later version of Spring Security where the internal/external IP address classification failed to recognize IPv4/IPv6 \"any local\" address..."
    }
  ]
}