{ "@id": "urn:uuid:2eeb4f04-ba69-4942-aeee-83924d2e7628", "role": "Document Creator", "author": "https://tuxcare.com", "version": 36, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-31T07:29:00.091551+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T13:08:55.544353+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.1.19.RELEASE is not affected by CVE-2009-1190. The vulnerability requires JDK before 1.6 (where Pattern.compile has algorithmic complexity issues) combined with Spring Framework 1.1.0-2.5.6 or 3.0.0.M1-M2. The target requires JDK 8+ (sourceCompatibility=1.8), which fixed the underlying regex engine vulnerability ~8 years before Spring 5.1.19 was released. While RemoteInvocati...", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 Spring Framework 5.1.19.RELEASE is not affected by CVE-2009-1190. The vulnerability requires JDK before 1.6 (where Pattern.compile has algorithmic complexity issues) combined with Spring Framework 1.1.0-2.5.6 or 3.0.0.M1-M2. The target requires JDK 8+ (sourceCompatibility=1.8), which fixed the underlying regex engine vulnerability ~8 years before Spring 5.1.19 was released. While RemoteInvocati..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2011-2730 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2011-2730" }, "action_statement": "Vulnerability CVE-2011-2730 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T02:23:11.597840+00:00", "status_notes": "Vulnerability CVE-2011-2894 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2011-2894" }, "action_statement": "Vulnerability CVE-2011-2894 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-31T07:29:00.091551+00:00", "status_notes": "Vulnerability CVE-2013-4152 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 affects Spring Framework before version 3.2.4 (XXE vulnerability in OXM JAXB marshaller). The target is Spring Framework 5.1.19.RELEASE (2019), which is 6+ years newer than the affected versions. The upstream Spring team applied comprehensive XXE protections in July 2013 (commit 2c030d4dcf by Arjen Poutsma): added processExternalEntities field defaulting to false, processSource() ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-4152" }, "impact_statement": "not_affected \u2014 CVE-2013-4152 affects Spring Framework before version 3.2.4 (XXE vulnerability in OXM JAXB marshaller). The target is Spring Framework 5.1.19.RELEASE (2019), which is 6+ years newer than the affected versions. The upstream Spring team applied comprehensive XXE protections in July 2013 (commit 2c030d4dcf by Arjen Poutsma): added processExternalEntities field defaulting to false, processSource() ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-31T06:08:24.643807+00:00", "status_notes": "Vulnerability CVE-2013-7315 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.1.19.RELEASE is not affected by CVE-2013-7315. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entity resolution, and installing a no-op XML resolver. This upstream fix was introduced in Spring Framework 5.0 RC3 (July 2017, commit e4651d6b50) and was already present in the 5.1.19.RELEASE th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-7315" }, "impact_statement": "not_affected \u2014 Spring Framework 5.1.19.RELEASE is not affected by CVE-2013-7315. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entity resolution, and installing a no-op XML resolver. This upstream fix was introduced in Spring Framework 5.0 RC3 (July 2017, commit e4651d6b50) and was already present in the 5.1.19.RELEASE th..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2014-3578 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2014-3578" }, "action_statement": "Vulnerability CVE-2014-3578 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T13:39:01.836668+00:00", "status_notes": "Vulnerability CVE-2015-0201 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2015-0201" }, "action_statement": "Vulnerability CVE-2015-0201 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2015-5211 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2015-5211" }, "action_statement": "Vulnerability CVE-2015-5211 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2016-5007 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2016-5007" }, "action_statement": "Vulnerability CVE-2016-5007 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2018-11040 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-11040" }, "action_statement": "Vulnerability CVE-2018-11040 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2018-1199 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-1199" }, "action_statement": "Vulnerability CVE-2018-1199 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.1.19.RELEASE. The vulnerability affected versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The fix was introduced upstream in April 2018 and included in Spring Framework 5.1.0.RC1 (and all subsequent 5.1.x releases). The target version 5.1.19.RELEASE contains the complete upstream fix: the selector header name can be set to null to disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1257" }, "impact_statement": "not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.1.19.RELEASE. The vulnerability affected versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The fix was introduced upstream in April 2018 and included in Spring Framework 5.1.0.RC1 (and all subsequent 5.1.x releases). The target version 5.1.19.RELEASE contains the complete upstream fix: the selector header name can be set to null to disab..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T02:48:12.612717+00:00", "status_notes": "Vulnerability CVE-2018-1258 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-1258" }, "action_statement": "Vulnerability CVE-2018-1258 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T19:17:00.109182+00:00", "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.1.19.RELEASE. The upstream fix commits (SPR-16616) that add URL-decoded path validation and backslash normalization were already included in the Spring Framework 5.1.19.RELEASE that TuxCare onboarded. The fix code is comprehensively present in both webmvc and webflux modules, implementing defense-in-depth with ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1271" }, "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.1.19.RELEASE. The upstream fix commits (SPR-16616) that add URL-decoded path validation and backslash normalization were already included in the Spring Framework 5.1.19.RELEASE that TuxCare onboarded. The fix code is comprehensively present in both webmvc and webflux modules, implementing defense-in-depth with ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2018-1272 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-1272" }, "action_statement": "Vulnerability CVE-2018-1272 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T22:02:19.515243+00:00", "status_notes": "Vulnerability CVE-2018-15756 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-15756" }, "action_statement": "Vulnerability CVE-2018-15756 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-21T13:47:00.213329+00:00", "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2021-22096" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-21T13:46:00.076092+00:00", "status_notes": "Vulnerability CVE-2022-22965 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2022-22965" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-21T13:44:57.645665+00:00", "status_notes": "Vulnerability CVE-2022-22970 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2022-22970" }, "action_statement": "Vulnerability CVE-2022-22970 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T03:39:22.988337+00:00", "status_notes": "Vulnerability CVE-2024-22233 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2024-22233" }, "action_statement": "Vulnerability CVE-2024-22233 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-21T13:44:57.645665+00:00", "status_notes": "Vulnerability CVE-2025-41249 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2025-41249" }, "action_statement": "Vulnerability CVE-2025-41249 affects version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-21T13:47:00.213329+00:00", "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2026-41848" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@5.1.19.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-21T13:46:00.076092+00:00", "status_notes": "Vulnerability CVE-2026-59282 is fixed in version 5.1.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2026-59282" } } ] }