{
  "@id": "urn:uuid:b7012b0f-530b-450a-aba0-49222b4b60a2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 39,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T18:35:35.339720+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T12:16:00.176399+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.0.16-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2009-1190. The vulnerability required Java deserialization through Spring's RPC-style remoting components (HttpInvoker, RMI remoting, etc.) to trigger pathological regex compilation in JDK < 1.6. Spring Framework 6.0 completely removed all RPC-style remoting infrastructure in commit 5822f1bf85 (Sept 2021) by upstream developer Juergen Hoeller. This...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2009-1190. The vulnerability required Java deserialization through Spring's RPC-style remoting components (HttpInvoker, RMI remoting, etc.) to trigger pathological regex compilation in JDK < 1.6. Spring Framework 6.0 completely removed all RPC-style remoting infrastructure in commit 5822f1bf85 (Sept 2021) by upstream developer Juergen Hoeller. This..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T21:30:41.069534+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "action_statement": "Vulnerability CVE-2011-2730 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T02:23:11.597840+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "action_statement": "Vulnerability CVE-2011-2894 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "action_statement": "Vulnerability CVE-2014-3578 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T13:39:01.836668+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "action_statement": "Vulnerability CVE-2015-0201 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "action_statement": "Vulnerability CVE-2015-5211 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "action_statement": "Vulnerability CVE-2018-11040 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T09:01:17.494754+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.0.16-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 CVE-2018-1257 is not present in Spring Framework 6.0.16. The vulnerability was fixed in the upstream release through commit ff2228fdaf (SPR-16732) authored by Spring developer Rossen Stoyanchev in April 2018. This fix, which allows disabling SpEL selector support to prevent ReDoS attacks, shipped with the upstream Spring Framework 6.0.16 release that TuxCare onboarded. The target repository con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 is not present in Spring Framework 6.0.16. The vulnerability was fixed in the upstream release through commit ff2228fdaf (SPR-16732) authored by Spring developer Rossen Stoyanchev in April 2018. This fix, which allows disabling SpEL selector support to prevent ReDoS attacks, shipped with the upstream Spring Framework 6.0.16 release that TuxCare onboarded. The target repository con..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T02:48:12.612717+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "action_statement": "Vulnerability CVE-2018-1258 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T18:35:35.339720+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.0.16-tuxcare.4 of org.springframework:spring-core. not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2018-1271. All defenses introduced by the security patches are present in the target code. The vulnerability allowed directory traversal via specially crafted URLs with encoded path sequences, backslashes, or duplicate slashes when serving static resources on Windows. The target contains complete protections: (1) processPath() normalizes backslashe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2018-1271. All defenses introduced by the security patches are present in the target code. The vulnerability allowed directory traversal via specially crafted URLs with encoded path sequences, backslashes, or duplicate slashes when serving static resources on Windows. The target contains complete protections: (1) processPath() normalizes backslashe..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:02:19.515243+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "action_statement": "Vulnerability CVE-2018-15756 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.4 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-07T16:41:15.493320+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core, and is fixed in 6.0.16-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 6.0.16-tuxcare.4 of org.springframework:spring-core, and is fixed in 6.0.16-tuxcare.10."
    }
  ]
}