{
  "@id": "urn:uuid:8dd35719-c06f-4c40-93f0-76b90fbb63c2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T22:59:00.114476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T20:51:00.153763+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2010-3700. The vulnerability allowed bypassing security constraints via path parameters (semicolons in URLs). The fix was introduced in commit 7d97adc687 by upstream developer Luke Taylor in October 2010, shipping RequestWrapper to strip semicolons and HttpFirewall infrastructure. This fix is an ancestor of the first TuxCare commit (onboarding of 5.5...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2010-3700. The vulnerability allowed bypassing security constraints via path parameters (semicolons in URLs). The fix was introduced in commit 7d97adc687 by upstream developer Luke Taylor in October 2010, shipping RequestWrapper to strip semicolons and HttpFirewall infrastructure. This fix is an ancestor of the first TuxCare commit (onboarding of 5.5..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:21:00.085443+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Target Spring Security 5.5.8 is NOT affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager allowing cross-thread authentication leakage) was fixed by upstream Spring Security in commits 5fce0a58bd (SEC-1750, Jul 2011) and 9a9aafaeec (SEC-1967, Jul 2012), both authored by luke.taylor@springsource.com. These fixes shipped in the upstream 5.5.8 release that TuxCare onboarded ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 5.5.8 is NOT affected by CVE-2011-2731. The vulnerability (race condition in RunAsManager allowing cross-thread authentication leakage) was fixed by upstream Spring Security in commits 5fce0a58bd (SEC-1750, Jul 2011) and 9a9aafaeec (SEC-1967, Jul 2012), both authored by luke.taylor@springsource.com. These fixes shipped in the upstream 5.5.8 release that TuxCare onboarded ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:59:00.114476+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2011-2732 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target (Spring Security 5.5.8-tuxcare.2) is NOT AFFECTED because the upstream vendor fix is already present in the codebase. The fix was authored by Luke Taylor (SpringSource) in commit 824464516c and shipped with the upstream Spring Security 5.5.8 release that TuxCare onboarded. The CRLF validation in Firew...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 affects Spring Security versions before 2.0.7 and 3.0.x before 3.0.6. The target (Spring Security 5.5.8-tuxcare.2) is NOT AFFECTED because the upstream vendor fix is already present in the codebase. The fix was authored by Luke Taylor (SpringSource) in commit 824464516c and shipped with the upstream Spring Security 5.5.8 release that TuxCare onboarded. The CRLF validation in Firew..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:37:14.366963+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2011-2894 is not present in Spring Security 5.5.8. The vulnerability involved deserializing entire SecurityContext objects in ContextPropagatingRemoteInvocation, enabling arbitrary code execution through Java deserialization gadgets. The upstream Spring Security project fixed this in commit b48fc53fa2 (SEC-1741) on May 20, 2011 by Luke Taylor, replacing SecurityContext serialization with st...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 is not present in Spring Security 5.5.8. The vulnerability involved deserializing entire SecurityContext objects in ContextPropagatingRemoteInvocation, enabling arbitrary code execution through Java deserialization gadgets. The upstream Spring Security project fixed this in commit b48fc53fa2 (SEC-1741) on May 20, 2011 by Luke Taylor, replacing SecurityContext serialization with st..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:10:21.701598+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 5.5.8. The vulnerability (timing attack allowing username enumeration via differential response times) was fixed by upstream Spring Security in commit c076f0f2e1 (SEC-2056) authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream Spring Security 5.5.8 release that TuxCare onboarded. The target code contains the compl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 is NOT present in Spring Security 5.5.8. The vulnerability (timing attack allowing username enumeration via differential response times) was fixed by upstream Spring Security in commit c076f0f2e1 (SEC-2056) authored by Rob Winch (rwinch@vmware.com). This fix was already present in the upstream Spring Security 5.5.8 release that TuxCare onboarded. The target code contains the compl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "action_statement": "Vulnerability CVE-2014-3527 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "action_statement": "Vulnerability CVE-2016-9879 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "action_statement": "Vulnerability CVE-2017-4995 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "action_statement": "Vulnerability CVE-2018-15801 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "action_statement": "Vulnerability CVE-2019-11272 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T16:47:27.426165+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Target is Spring Security 5.5.8 (official upstream release), newer than every CVE-2020-5408 affected range (fix landed in 5.3.2/5.2.4/5.1.10/5.0.16/4.2.16). CVE-2020-5408: Encryptors.queryableText() uses a fixed all-zero (null) IV with AES-CBC, producing deterministic ciphertext that lets an attacker with read access to stored ciphertext derive plaintext via dictionary/frequency attacks. The vendor's fix (the exact input patch, commit db155b3094 \"Clean up Javadoc\") did NOT add a random IV \u2014 doing so would break the deterministic-query feature \u2014 it instead DEPRECATED the queryableText() method with the note \"This encryptor is not secure. Instead, look to your data store for a mechanism to query encrypted data.\" That deprecation is present in the target: Encryptors.java lines 103-107 carry @deprecated + @Deprecated on queryableText(), and commit db155b3094 is confirmed an ancestor of HEAD. Per Rule 3 (trust vendor fix intent), deprecation is the authoritative fix and must not be deemed \"insufficient.\" The fix commit is authored by Eleftheria Stein <eleftheria.kousathana@gmail.com> (upstream Spring, not TuxCare/CloudLinux), and HEAD (5.5.8) is an upstream release by sriesenberg@vmware.com \u2014 so this is the UPSTREAM-fix sub-case of not_affected (justification code_not_present), not already_fixed. Patch 2 (d1909ec, BCryptPasswordEncoder null-check) is unrelated to this CVE. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "impact_statement": "not_affected \u2014 Target is Spring Security 5.5.8 (official upstream release), newer than every CVE-2020-5408 affected range (fix landed in 5.3.2/5.2.4/5.1.10/5.0.16/4.2.16). CVE-2020-5408: Encryptors.queryableText() uses a fixed all-zero (null) IV with AES-CBC, producing deterministic ciphertext that lets an attacker with read access to stored ciphertext derive plaintext via dictionary/frequency attacks. The vendor's fix (the exact input patch, commit db155b3094 \"Clean up Javadoc\") did NOT add a random IV \u2014 doing so would break the deterministic-query feature \u2014 it instead DEPRECATED the queryableText() method with the note \"This encryptor is not secure. Instead, look to your data store for a mechanism to query encrypted data.\" That deprecation is present in the target: Encryptors.java lines 103-107 carry @deprecated + @Deprecated on queryableText(), and commit db155b3094 is confirmed an ancestor of HEAD. Per Rule 3 (trust vendor fix intent), deprecation is the authoritative fix and must not be deemed \"insufficient.\" The fix commit is authored by Eleftheria Stein <eleftheria.kousathana@gmail.com> (upstream Spring, not TuxCare/CloudLinux), and HEAD (5.5.8) is an upstream release by sriesenberg@vmware.com \u2014 so this is the UPSTREAM-fix sub-case of not_affected (justification code_not_present), not already_fixed. Patch 2 (d1909ec, BCryptPasswordEncoder null-check) is unrelated to this CVE. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "action_statement": "Vulnerability CVE-2021-22112 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:25:24.582887+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "action_statement": "Vulnerability CVE-2022-22976 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "action_statement": "Vulnerability CVE-2022-31692 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "action_statement": "Vulnerability CVE-2023-20862 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:00:50.903105+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "action_statement": "Vulnerability CVE-2024-38810 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:23:11.597840+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2025-22223. This vulnerability specifically affects Spring Security 6.0+ systems using @EnableMethodSecurity, where the UniqueSecurityAnnotationScanner class fails to resolve generic type parameters correctly. Version 5.5.8 does not have @EnableMethodSecurity or UniqueSecurityAnnotationScanner\u2014it uses the older @EnableGlobalMethodSecurity infrastruct...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2025-22223. This vulnerability specifically affects Spring Security 6.0+ systems using @EnableMethodSecurity, where the UniqueSecurityAnnotationScanner class fails to resolve generic type parameters correctly. Version 5.5.8 does not have @EnableMethodSecurity or UniqueSecurityAnnotationScanner\u2014it uses the older @EnableGlobalMethodSecurity infrastruct..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2025-22228"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T16:47:27.426165+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.5.8 (released May 2022) does NOT contain CVE-2025-22234. This CVE is a regression bug introduced by patch 1 (commit c1aa99fdd2, April 2025) which added conditional 72-byte password length enforcement to BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target repository lacks this conditional check entirely\u2014BCrypt.java contains no passw...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 (released May 2022) does NOT contain CVE-2025-22234. This CVE is a regression bug introduced by patch 1 (commit c1aa99fdd2, April 2025) which added conditional 72-byte password length enforcement to BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target repository lacks this conditional check entirely\u2014BCrypt.java contains no passw..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:47:12.586674+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.5.8 does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.5.8 does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T11:36:00.176663+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.5.8 predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.5.8 predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.5.8-tuxcare.2 does not contain the vulnerable JdbcOneTimeTokenService class or the One-Time Token (OTT) authentication feature. The OTT feature was introduced in later versions (6.5.x+) and does not exist in version 5.5.8. Exhaustive searches confirmed no OTT-related code, classes, or packages are present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8-tuxcare.2 does not contain the vulnerable JdbcOneTimeTokenService class or the One-Time Token (OTT) authentication feature. The OTT feature was introduced in later versions (6.5.x+) and does not exist in version 5.5.8. Exhaustive searches confirmed no OTT-related code, classes, or packages are present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T16:47:27.426165+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. Spring Security 5.5.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher.Builder (Spring Security 7.0.0-7.0.4) where a builder pattern bug prevents the basePath from being configured, causing servlet-path-aware authorization rules to be bypassed. Version 5.5.8 uses a different architecture (MvcRequestMatcher) that correctly handles servlet-path configuration through direct property assignment rather than a builder pattern, and therefore does not contain the vulnerable code path.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Spring Security 5.5.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher.Builder (Spring Security 7.0.0-7.0.4) where a builder pattern bug prevents the basePath from being configured, causing servlet-path-aware authorization rules to be bypassed. Version 5.5.8 uses a different architecture (MvcRequestMatcher) that correctly handles servlet-path configuration through direct property assignment rather than a builder pattern, and therefore does not contain the vulnerable code path."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:03:15.189186+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T16:47:27.426165+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      },
      "action_statement": "Vulnerability CVE-2026-47838 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:33:04.556385+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.5.8 contains no WebAuthn code, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.5.8 contains no WebAuthn code, so it is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:54:00.174826+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      },
      "action_statement": "Vulnerability CVE-2026-47842 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:54:00.174826+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() methods does not exist in this version. This class was introduced in Spring Security 7.1.x, multiple major versions after 5.5.8. The target version only contains IpAddressMatcher, which matches specific IP addresses or CIDR ranges but does not perform internal/e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() methods does not exist in this version. This class was introduced in Spring Security 7.1.x, multiple major versions after 5.5.8. The target version only contains IpAddressMatcher, which matches specific IP addresses or CIDR ranges but does not perform internal/e..."
    }
  ]
}