{
  "@id": "urn:uuid:2959fbef-58de-4142-933a-baa8605527d6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:10:26.706684+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T21:01:09.226514+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (e.g., /admin.html;x=user.html). The target (Spring Security 6.4.13) is not affected because the fix (SEC-1584) was added by Luke Taylor in October 2010 and has been part of Spring Security since version 3.1. The defense strips path parameters from s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-3700 affects Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, allowing attackers to bypass security constraints via path parameters (e.g., /admin.html;x=user.html). The target (Spring Security 6.4.13) is not affected because the fix (SEC-1584) was added by Luke Taylor in October 2010 and has been part of Spring Security since version 3.1. The defense strips path parameters from s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T19:32:16.768619+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2011-2731 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target (version 6.4.13) contains the complete upstream fix from 2011-2012 (SEC-1750 and SEC-1967). The vulnerable pattern\u2014storing RunAs Authentication in a shared SecurityContext accessible across threads\u2014is not present. The fix creates an isolated SecurityContext per RunAs operation (AbstractSecurityInterceptor line...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 affects Spring Security before 2.0.7 and 3.0.x before 3.0.6. The target (version 6.4.13) contains the complete upstream fix from 2011-2012 (SEC-1750 and SEC-1967). The vulnerable pattern\u2014storing RunAs Authentication in a shared SecurityContext accessible across threads\u2014is not present. The fix creates an isolated SecurityContext per RunAs operation (AbstractSecurityInterceptor line..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T23:10:26.706684+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 The target (Spring Security 6.4.13) is NOT AFFECTED by CVE-2011-2732. The vulnerability pattern (CRLF injection in logout redirects) is not present because upstream Spring Security fixed this issue years ago. Both defense mechanisms from the vendor patches are present: (1) FirewalledResponse validates all redirect locations and rejects any containing CR or LF characters, and (2) targetUrlParame...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Security 6.4.13) is NOT AFFECTED by CVE-2011-2732. The vulnerability pattern (CRLF injection in logout redirects) is not present because upstream Spring Security fixed this issue years ago. Both defense mechanisms from the vendor patches are present: (1) FirewalledResponse validates all redirect locations and rejects any containing CR or LF characters, and (2) targetUrlParame..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T22:48:48.232589+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2011-2894 affects Spring Security 2.0.0-2.0.6 and 3.0.0-3.0.5 via unsafe deserialization in the RMI remoting module's ContextPropagatingRemoteInvocation class. The target version 6.4.13 is not affected because the entire Spring Security remoting module (including all RMI support) was removed by upstream in October 2021 (commit b2e6c60d94, included in Spring Security 6.0.0-M1 and all subsequ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security 2.0.0-2.0.6 and 3.0.0-3.0.5 via unsafe deserialization in the RMI remoting module's ContextPropagatingRemoteInvocation class. The target version 6.4.13 is not affected because the entire Spring Security remoting module (including all RMI support) was removed by upstream in October 2021 (commit b2e6c60d94, included in Spring Security 6.0.0-M1 and all subsequ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T21:17:59.994008+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2012-5055 (SEC-2056): The timing-based username enumeration vulnerability is NOT present in Spring Security 6.4.13. The fix was implemented by upstream (Rob Winch, VMware) in commit c076f0f2e1 and shipped in the upstream release that TuxCare onboarded. The target code contains complete mitigation: prepareTimingAttackProtection() ensures a dummy password is pre-encoded, and mitigateAgainstTi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (SEC-2056): The timing-based username enumeration vulnerability is NOT present in Spring Security 6.4.13. The fix was implemented by upstream (Rob Winch, VMware) in commit c076f0f2e1 and shipped in the upstream release that TuxCare onboarded. The target code contains complete mitigation: prepareTimingAttackProtection() ensures a dummy password is pre-encoded, and mitigateAgainstTi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "action_statement": "Vulnerability CVE-2019-11272 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T22:08:47.711669+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2020-5408 affects Spring Security versions that use a fixed null initialization vector (IV) with CBC mode in the queryable text encryptor, enabling dictionary attacks. The target repository (Spring Security 6.4.13-tuxcare.7) is not affected because the vulnerable `queryableText()` method has been completely removed. This removal was performed by upstream maintainer Rob Winch in commit d996c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5408 affects Spring Security versions that use a fixed null initialization vector (IV) with CBC mode in the queryable text encryptor, enabling dictionary attacks. The target repository (Spring Security 6.4.13-tuxcare.7) is not affected because the vulnerable `queryableText()` method has been completely removed. This removal was performed by upstream maintainer Rob Winch in commit d996c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "action_statement": "Vulnerability CVE-2021-22112 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      },
      "action_statement": "Vulnerability CVE-2024-38821 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T20:02:15.054048+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2024-38827 is NOT present in spring-security 6.4.13. The vulnerability (locale-dependent String case conversion in authorization code) was fixed upstream by commit a7bf8f7cc6 on October 28, 2024, and this fix was already included in the upstream Spring Security 6.4.13 release that TuxCare onboarded. All authorization-critical code now uses Locale.ROOT or Locale.ENGLISH for case conversion, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38827 is NOT present in spring-security 6.4.13. The vulnerability (locale-dependent String case conversion in authorization code) was fixed upstream by commit a7bf8f7cc6 on October 28, 2024, and this fix was already included in the upstream Spring Security 6.4.13 release that TuxCare onboarded. All authorization-critical code now uses Locale.ROOT or Locale.ENGLISH for case conversion, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:18:37.843029+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2025-22223. The vulnerability (incorrect annotation location on parameterized types causing authorization bypass) was fixed in upstream commit dc2e1af2da by Josh Cummings on 2025-01-08. This fix shipped in the upstream 6.4.13 release that TuxCare onboarded on 2026-07-17. The target contains the complete fix at lines 215-261 of UniqueSecurityAnnotati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2025-22223. The vulnerability (incorrect annotation location on parameterized types causing authorization bypass) was fixed in upstream commit dc2e1af2da by Josh Cummings on 2025-01-08. This fix shipped in the upstream 6.4.13 release that TuxCare onboarded on 2026-07-17. The target contains the complete fix at lines 215-261 of UniqueSecurityAnnotati..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:32:37.090382+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2025-22228"
      },
      "action_statement": "Vulnerability CVE-2025-22228 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2025-22234 is NOT present in Spring Security 6.4.13. The vulnerability (broken timing attack mitigation caused by unconditional BCrypt 72-byte password limit enforcement) was fixed in upstream commit c1aa99fdd2 which shipped with Spring Security 6.4.13. The fix modified BCrypt to only enforce the 72-byte limit when encoding new passwords (!for_check), allowing password matching to proceed n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 is NOT present in Spring Security 6.4.13. The vulnerability (broken timing attack mitigation caused by unconditional BCrypt 72-byte password limit enforcement) was fixed in upstream commit c1aa99fdd2 which shipped with Spring Security 6.4.13. The fix modified BCrypt to only enforce the 72-byte limit when encoding new passwords (!for_check), allowing password matching to proceed n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T10:49:55.998641+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. Spring Security 6.4.13 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "Spring Security 6.4.13 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T11:37:35.533056+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. Spring Security 6.4.13 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Spring Security 6.4.13 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. Spring Security 6.4.13 is outside the affected range (7.0.0\u20137.0.4). CVE-2026-22747 affects the DN parsing logic in SubjectX500PrincipalExtractor, which can incorrectly extract a username from a certificate subject. This class and its associated authentication path are absent in 6.4.13, where X.509 authentication uses SubjectDnX509PrincipalExtractor instead. Therefore, the vulnerable code path does not exist in this version.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      },
      "impact_statement": "Spring Security 6.4.13 is outside the affected range (7.0.0\u20137.0.4). CVE-2026-22747 affects the DN parsing logic in SubjectX500PrincipalExtractor, which can incorrectly extract a username from a certificate subject. This class and its associated authentication path are absent in 6.4.13, where X.509 authentication uses SubjectDnX509PrincipalExtractor instead. Therefore, the vulnerable code path does not exist in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2026-22751"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a bug in PathPatternRequestMatcherFactoryBean where the builder's basePath() method is called without capturing its return value. Version 6.4.13 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean classes. Instead, it uses the older MvcRequestMa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a bug in PathPatternRequestMatcherFactoryBean where the builder's basePath() method is called without capturing its return value. Version 6.4.13 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean classes. Instead, it uses the older MvcRequestMa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T12:13:41.094671+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test, and is fixed in 6.4.13-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      },
      "action_statement": "Vulnerability CVE-2026-41706 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test, and is fixed in 6.4.13-tuxcare.6."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T12:13:41.094671+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test, and is fixed in 6.4.13-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "action_statement": "Vulnerability CVE-2026-47841 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test, and is fixed in 6.4.13-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T12:13:41.094671+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test, and is fixed in 6.4.13-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      },
      "action_statement": "Vulnerability CVE-2026-47842 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test, and is fixed in 6.4.13-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T12:13:41.094671+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test, and is fixed in 6.4.13-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test, and is fixed in 6.4.13-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. Exhaustive searches confirmed the class is absent from the entire codebase, including all tracked branches and tags up to 6.5.11. The InetAddressMatchers utility class appears to have been introduced in a lat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. Exhaustive searches confirmed the class is absent from the entire codebase, including all tracked branches and tags up to 6.5.11. The InetAddressMatchers utility class appears to have been introduced in a lat..."
    }
  ]
}