{
  "@id": "urn:uuid:17ff93c6-2eda-4d1b-ab56-c8d148f7c534",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:10:26.706684+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:00:21.256293+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 CVE-2010-3700 allows bypassing security constraints via path parameters (e.g., /admin;jsessionid=xxx). The vulnerability was fixed in Spring Security 3.0.4/2.0.6 via SEC-1584, which introduced HttpFirewall to strip path parameters before URL pattern matching. The target (Spring Security 5.1.6.RELEASE) already contains this fix in the upstream release that TuxCare onboarded. The fix commit (7d97...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 allows bypassing security constraints via path parameters (e.g., /admin;jsessionid=xxx). The vulnerability was fixed in Spring Security 3.0.4/2.0.6 via SEC-1584, which introduced HttpFirewall to strip path parameters before URL pattern matching. The target (Spring Security 5.1.6.RELEASE) already contains this fix in the upstream release that TuxCare onboarded. The fix commit (7d97..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:32:47.509416+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 The target Spring Security 5.1.6.RELEASE is not affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed by upstream developers in 2011 (SEC-1750) and 2012 (SEC-1967), well before the 5.1.6.RELEASE version. Both fix commits (5fce0a58bd and 9a9aafaeec) are present in HEAD's ancestry and were part of the upstream release that TuxCare onboarded. The vulnerable pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.1.6.RELEASE is not affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed by upstream developers in 2011 (SEC-1750) and 2012 (SEC-1967), well before the 5.1.6.RELEASE version. Both fix commits (5fce0a58bd and 9a9aafaeec) are present in HEAD's ancestry and were part of the upstream release that TuxCare onboarded. The vulnerable pattern ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T23:10:26.706684+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.1.6.RELEASE-tuxcare.2. The vulnerability was fixed in upstream Spring Security via commit 824464516c (SEC-1790) by Luke Taylor in 2011, which added FirewalledResponse to validate redirect locations and reject any containing CR/LF characters. This fix was already present in the upstream 5.1.6.RELEASE before Tux...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.1.6.RELEASE-tuxcare.2. The vulnerability was fixed in upstream Spring Security via commit 824464516c (SEC-1790) by Luke Taylor in 2011, which added FirewalledResponse to validate redirect locations and reject any containing CR/LF characters. This fix was already present in the upstream 5.1.6.RELEASE before Tux..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:49:26.569452+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 CVE-2011-2894 affects Spring Security versions 2.0.0-2.0.6 and 3.0.0-3.0.5 due to unsafe deserialization of entire SecurityContext objects in RMI remote invocations. The target (Spring Security 5.1.6.RELEASE-tuxcare.2) is NOT AFFECTED because the vulnerable pattern is not present. The upstream vendor fix (SEC-1741, commit b48fc53fa2 by Luke Taylor from SpringSource) was already included in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security versions 2.0.0-2.0.6 and 3.0.0-3.0.5 due to unsafe deserialization of entire SecurityContext objects in RMI remote invocations. The target (Spring Security 5.1.6.RELEASE-tuxcare.2) is NOT AFFECTED because the vulnerable pattern is not present. The upstream vendor fix (SEC-1741, commit b48fc53fa2 by Luke Taylor from SpringSource) was already included in the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:17:59.994008+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.1.6.RELEASE. The fix was applied by upstream Spring Security in 2012 (commit c076f0f2e1 by Rob Winch) and was already included in the 5.1.6.RELEASE version when TuxCare onboarded it in 2026. The target code contains comprehensive timing attack mitigation via the mitigateAgainstTimingAttack() method, which performs pas...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.1.6.RELEASE. The fix was applied by upstream Spring Security in 2012 (commit c076f0f2e1 by Rob Winch) and was already included in the 5.1.6.RELEASE version when TuxCare onboarded it in 2026. The target code contains comprehensive timing attack mitigation via the mitigateAgainstTimingAttack() method, which performs pas..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "action_statement": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "action_statement": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:18:37.843029+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:45:50.947674+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T11:35:00.150371+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T13:56:00.078920+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,..."
    }
  ]
}