{ "@id": "urn:uuid:b315f459-a093-43d8-a6c9-dfb01dc9ddd6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 24, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T23:10:26.706684+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T21:00:21.256293+00:00", "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2010-3700 allows bypassing security constraints via path parameters (e.g., /admin;jsessionid=xxx). The vulnerability was fixed in Spring Security 3.0.4/2.0.6 via SEC-1584, which introduced HttpFirewall to strip path parameters before URL pattern matching. The target (Spring Security 5.1.6.RELEASE) already contains this fix in the upstream release that TuxCare onboarded. The fix commit (7d97...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2010-3700" }, "impact_statement": "not_affected \u2014 CVE-2010-3700 allows bypassing security constraints via path parameters (e.g., /admin;jsessionid=xxx). The vulnerability was fixed in Spring Security 3.0.4/2.0.6 via SEC-1584, which introduced HttpFirewall to strip path parameters before URL pattern matching. The target (Spring Security 5.1.6.RELEASE) already contains this fix in the upstream release that TuxCare onboarded. The fix commit (7d97..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T19:32:47.509416+00:00", "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 The target Spring Security 5.1.6.RELEASE is not affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed by upstream developers in 2011 (SEC-1750) and 2012 (SEC-1967), well before the 5.1.6.RELEASE version. Both fix commits (5fce0a58bd and 9a9aafaeec) are present in HEAD's ancestry and were part of the upstream release that TuxCare onboarded. The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2731" }, "impact_statement": "not_affected \u2014 The target Spring Security 5.1.6.RELEASE is not affected by CVE-2011-2731. The race condition vulnerability in RunAsManager was fixed by upstream developers in 2011 (SEC-1750) and 2012 (SEC-1967), well before the 5.1.6.RELEASE version. Both fix commits (5fce0a58bd and 9a9aafaeec) are present in HEAD's ancestry and were part of the upstream release that TuxCare onboarded. The vulnerable pattern ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T23:10:26.706684+00:00", "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.1.6.RELEASE-tuxcare.2. The vulnerability was fixed in upstream Spring Security via commit 824464516c (SEC-1790) by Luke Taylor in 2011, which added FirewalledResponse to validate redirect locations and reject any containing CR/LF characters. This fix was already present in the upstream 5.1.6.RELEASE before Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2732" }, "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout redirect) is NOT present in Spring Security 5.1.6.RELEASE-tuxcare.2. The vulnerability was fixed in upstream Spring Security via commit 824464516c (SEC-1790) by Luke Taylor in 2011, which added FirewalledResponse to validate redirect locations and reject any containing CR/LF characters. This fix was already present in the upstream 5.1.6.RELEASE before Tux..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T22:49:26.569452+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2011-2894 affects Spring Security versions 2.0.0-2.0.6 and 3.0.0-3.0.5 due to unsafe deserialization of entire SecurityContext objects in RMI remote invocations. The target (Spring Security 5.1.6.RELEASE-tuxcare.2) is NOT AFFECTED because the vulnerable pattern is not present. The upstream vendor fix (SEC-1741, commit b48fc53fa2 by Luke Taylor from SpringSource) was already included in the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security versions 2.0.0-2.0.6 and 3.0.0-3.0.5 due to unsafe deserialization of entire SecurityContext objects in RMI remote invocations. The target (Spring Security 5.1.6.RELEASE-tuxcare.2) is NOT AFFECTED because the vulnerable pattern is not present. The upstream vendor fix (SEC-1741, commit b48fc53fa2 by Luke Taylor from SpringSource) was already included in the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T21:17:59.994008+00:00", "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.1.6.RELEASE. The fix was applied by upstream Spring Security in 2012 (commit c076f0f2e1 by Rob Winch) and was already included in the 5.1.6.RELEASE version when TuxCare onboarded it in 2026. The target code contains comprehensive timing attack mitigation via the mitigateAgainstTimingAttack() method, which performs pas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5055" }, "impact_statement": "not_affected \u2014 CVE-2012-5055 timing attack vulnerability is NOT present in Spring Security 5.1.6.RELEASE. The fix was applied by upstream Spring Security in 2012 (commit c076f0f2e1 by Rob Winch) and was already included in the 5.1.6.RELEASE version when TuxCare onboarded it in 2026. The target code contains comprehensive timing attack mitigation via the mitigateAgainstTimingAttack() method, which performs pas..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2014-0097" }, "action_statement": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T21:34:36.358672+00:00", "status_notes": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2014-3527" }, "action_statement": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T21:34:36.358672+00:00", "status_notes": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2016-5007" }, "action_statement": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T21:34:36.358672+00:00", "status_notes": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2016-9879" }, "action_statement": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2017-4995" }, "action_statement": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2018-1199" }, "action_statement": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2018-15801" }, "action_statement": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-28T21:34:36.358672+00:00", "status_notes": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2019-11272" }, "action_statement": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2019-3795" }, "action_statement": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2020-5407" }, "action_statement": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2020-5408" }, "action_statement": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2021-22112 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2021-22112" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2021-22119" }, "action_statement": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T01:25:24.582887+00:00", "status_notes": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2022-22976" }, "action_statement": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2022-22978" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2022-31692" }, "action_statement": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2023-20862" }, "action_statement": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T01:28:06.753409+00:00", "status_notes": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2024-22234" }, "action_statement": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2024-22257" }, "action_statement": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2024-38810" }, "action_statement": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2024-38821" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2024-38827" }, "action_statement": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T02:18:37.843029+00:00", "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22223" }, "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22234" }, "impact_statement": "not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T10:45:50.947674+00:00", "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-41232" }, "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T11:35:00.150371+00:00", "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-41248" }, "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2026-22732" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2026-22746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2026-22747" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T05:55:31.824924+00:00", "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22751" }, "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22754. The vulnerability is architecture-specific to version 7.0.0-7.0.4's PathPatternRequestMatcherFactoryBean, which uses an immutable builder pattern where the basePath() return value was not captured, causing servlet-path authorization rules to be silently ignored. Version 5.1.6 uses a completely different implementation (MvcRequestMatcher) with direct property setting via setServletPath() - no builder pattern exists. The servletPath property is correctly set during bean construction (via BeanDefinitionBuilder.addPropertyValue for XML config or direct setter calls for Java config) and is properly checked at runtime in MvcRequestMatcher.matches() lines 67-70, blocking requests that don't match the configured servlet path. Tests confirm servlet-path authorization works correctly in 5.1.6. This is Rule 5 Type B: alternative defense present at runtime.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22754" }, "impact_statement": "Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22754. The vulnerability is architecture-specific to version 7.0.0-7.0.4's PathPatternRequestMatcherFactoryBean, which uses an immutable builder pattern where the basePath() return value was not captured, causing servlet-path authorization rules to be silently ignored. Version 5.1.6 uses a completely different implementation (MvcRequestMatcher) with direct property setting via setServletPath() - no builder pattern exists. The servletPath property is correctly set during bean construction (via BeanDefinitionBuilder.addPropertyValue for XML config or direct setter calls for Java config) and is properly checked at runtime in MvcRequestMatcher.matches() lines 67-70, blocking requests that don't match the configured servlet path. Tests confirm servlet-path authorization works correctly in 5.1.6. This is Rule 5 Type B: alternative defense present at runtime." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2026-41706 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 5.1.6.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version. These classes were introduced later in Spring Security 5.4.0 (July 2020), while version 5.1.6 predates this introduction. The existing request caching implementations in 5.1.6 (HttpSessionRequestCache and WebSessionServerRequestCac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41706" }, "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version. These classes were introduced later in Spring Security 5.4.0 (July 2020), while version 5.1.6 predates this introduction. The existing request caching implementations in 5.1.6 (HttpSessionRequestCache and WebSessionServerRequestCac..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2026-47838 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2026-47838" }, "action_statement": "Vulnerability CVE-2026-47838 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T12:31:00.165767+00:00", "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.1.6.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47841" }, "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.1.6.RELEASE contains no WebAuthn code, so it is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-27T13:14:51.889465+00:00", "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test.", "vulnerability": { "name": "CVE-2026-59276" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-test@5.1.6.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59277" }, "impact_statement": "not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,..." } ] }