{ "@id": "urn:uuid:3a496cd2-5c80-4702-81da-66d5f17b9c12", "role": "Document Creator", "author": "https://tuxcare.com", "version": 52, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-31T04:00:47.339797+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T11:55:34.415642+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6. Spring Framework 5.3.30 requires JDK 8+ (confirmed by sourceCompatibility=1.8 in build.gradle), which includes the fix for this vulnerability. While Spring's PatternEditor still calls Pattern.compile without validation, the underlying JDK runtime provides protection against the ...", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK before 1.6. Spring Framework 5.3.30 requires JDK 8+ (confirmed by sourceCompatibility=1.8 in build.gradle), which includes the fix for this vulnerability. While Spring's PatternEditor still calls Pattern.compile without validation, the underlying JDK runtime provides protection against the ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2011-2730 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2011-2730" }, "action_statement": "Vulnerability CVE-2011-2730 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T02:23:11.597840+00:00", "status_notes": "Vulnerability CVE-2011-2894 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2011-2894" }, "action_statement": "Vulnerability CVE-2011-2894 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2013-6429 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2013-6429 affects Spring Framework's SourceHttpMessageConverter when external entity resolution is enabled by default in XML parsers. The target version (5.3.30) already contains the upstream fix from commit 2ae6a6a341 (November 2013, shipped in Spring Framework 4.0.0.RC2). The fix disables external entity resolution by default via the `processExternalEntities` field (defaults to false) and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-6429" }, "impact_statement": "not_affected \u2014 CVE-2013-6429 affects Spring Framework's SourceHttpMessageConverter when external entity resolution is enabled by default in XML parsers. The target version (5.3.30) already contains the upstream fix from commit 2ae6a6a341 (November 2013, shipped in Spring Framework 4.0.0.RC2). The fix disables external entity resolution by default via the `processExternalEntities` field (defaults to false) and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T11:03:36.038462+00:00", "status_notes": "Vulnerability CVE-2013-6430 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2013-6430 affects Spring Framework before version 3.2.2. The target version is 5.3.30, which is significantly later and already contains the upstream fix. The JavaScriptUtils.javaScriptEscape() method in the target properly escapes all four vulnerable characters: left angle bracket (<), right angle bracket (>), Unicode line separator (\\u2028), and Unicode paragraph separator (\\u2029). The f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-6430" }, "impact_statement": "not_affected \u2014 CVE-2013-6430 affects Spring Framework before version 3.2.2. The target version is 5.3.30, which is significantly later and already contains the upstream fix. The JavaScriptUtils.javaScriptEscape() method in the target properly escapes all four vulnerable characters: left angle bracket (<), right angle bracket (>), Unicode line separator (\\u2028), and Unicode paragraph separator (\\u2029). The f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T04:52:46.070068+00:00", "status_notes": "Vulnerability CVE-2014-0054 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 The target repository (Spring Framework 5.3.30) is not affected by CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter). The XXE protection fix was introduced in upstream Spring Framework version 4.0.2.RELEASE (February 2014) via commit edba32b3093, authored by Rossen Stoyanchev from the upstream Spring team (@gopivotal.com). Since the target version 5.3.30 is significantly newer than 4....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0054" }, "impact_statement": "not_affected \u2014 The target repository (Spring Framework 5.3.30) is not affected by CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter). The XXE protection fix was introduced in upstream Spring Framework version 4.0.2.RELEASE (February 2014) via commit edba32b3093, authored by Rossen Stoyanchev from the upstream Spring team (@gopivotal.com). Since the target version 5.3.30 is significantly newer than 4...." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T21:48:07.176896+00:00", "status_notes": "Vulnerability CVE-2014-0225 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2014-0225" }, "action_statement": "Vulnerability CVE-2014-0225 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-31T04:00:47.339797+00:00", "status_notes": "Vulnerability CVE-2014-1904 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.3.30 is not affected by CVE-2014-1904. The XSS vulnerability in FormTag's default action handling was fixed upstream in 2014 (versions 3.2.8 and 4.0.2). The fix - URI encoding via UriUtils.encodePath() - was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (unencoded requestUri inserted into form action attribute) does not exis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1904" }, "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.30 is not affected by CVE-2014-1904. The XSS vulnerability in FormTag's default action handling was fixed upstream in 2014 (versions 3.2.8 and 4.0.2). The fix - URI encoding via UriUtils.encodePath() - was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (unencoded requestUri inserted into form action attribute) does not exis..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2014-3578 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2014-3578" }, "action_statement": "Vulnerability CVE-2014-3578 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-31T01:53:30.890905+00:00", "status_notes": "Vulnerability CVE-2014-3625 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.3.30 is NOT affected by CVE-2014-3625. The vulnerability (directory traversal via path manipulation in static resource handling) was fixed by upstream commit 9cef8e3001 on 2014-11-11, authored by rstoyanchev@pivotal.io. This fix shipped in the upstream Spring Framework release that TuxCare onboarded (first TuxCare commit 491e7add6b on 2025-10-21). The target contai...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3625" }, "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.30 is NOT affected by CVE-2014-3625. The vulnerability (directory traversal via path manipulation in static resource handling) was fixed by upstream commit 9cef8e3001 on 2014-11-11, authored by rstoyanchev@pivotal.io. This fix shipped in the upstream Spring Framework release that TuxCare onboarded (first TuxCare commit 491e7add6b on 2025-10-21). The target contai..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T13:35:18.152026+00:00", "status_notes": "Vulnerability CVE-2015-0201 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2015-0201" }, "action_statement": "Vulnerability CVE-2015-0201 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T06:10:38.944031+00:00", "status_notes": "Vulnerability CVE-2015-3192 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2015-3192. The vulnerability (improper processing of inline DTD declarations leading to DoS via memory exhaustion) was fixed in the upstream Spring Framework release v4.2.0.RC2 (June 2015) by commit d79ec68db40. This fix was already present when the 5.3.30 release shipped (circa 2021), years before TuxCare onboarded this version in August 2025. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-3192" }, "impact_statement": "not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2015-3192. The vulnerability (improper processing of inline DTD declarations leading to DoS via memory exhaustion) was fixed in the upstream Spring Framework release v4.2.0.RC2 (June 2015) by commit d79ec68db40. This fix was already present when the 5.3.30 release shipped (circa 2021), years before TuxCare onboarded this version in August 2025. The..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2015-5211 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2015-5211" }, "action_statement": "Vulnerability CVE-2015-5211 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "vulnerability": { "name": "CVE-2016-1000027" }, "action_statement": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2016-5007 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2016-5007" }, "action_statement": "Vulnerability CVE-2016-5007 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T08:39:00.844115+00:00", "status_notes": "Vulnerability CVE-2016-9878 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.3.30 does not contain the vulnerable code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-9878" }, "impact_statement": "CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.3.30 does not contain the vulnerable code." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2018-11039 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2018-11039" }, "action_statement": "Vulnerability CVE-2018-11039 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2018-11040 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2018-11040" }, "action_statement": "Vulnerability CVE-2018-11040 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2018-1199 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2018-1199" }, "action_statement": "Vulnerability CVE-2018-1199 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T08:49:57.907521+00:00", "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with STOMP over WebSocket support that allowed regex DoS attacks through malicious selector headers. The target (5.3.30) is NOT AFFECTED because the upstream fix was already present in the Spring Framework 5.3.x release line before TuxCare's involvement. The fix (commit ff2228fdaf) by upstream developer rstoyanchev@pivotal.io added a null-check de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1257" }, "impact_statement": "not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with STOMP over WebSocket support that allowed regex DoS attacks through malicious selector headers. The target (5.3.30) is NOT AFFECTED because the upstream fix was already present in the Spring Framework 5.3.x release line before TuxCare's involvement. The fix (commit ff2228fdaf) by upstream developer rstoyanchev@pivotal.io added a null-check de..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T02:48:12.612717+00:00", "status_notes": "Vulnerability CVE-2018-1258 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2018-1258" }, "action_statement": "Vulnerability CVE-2018-1258 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T18:18:00.120764+00:00", "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.30. The upstream fix was already included in the Spring Framework 5.3.30 release that TuxCare onboarded. All four affected resource handler files contain the complete mitigation: isInvalidEncodedPath() methods check for both \"../\" and \"..\\\\\" patterns in URL-decoded paths, and processPath() methods normalize b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1271" }, "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.30. The upstream fix was already included in the Spring Framework 5.3.30 release that TuxCare onboarded. All four affected resource handler files contain the complete mitigation: isInvalidEncodedPath() methods check for both \"../\" and \"..\\\\\" patterns in URL-decoded paths, and processPath() methods normalize b..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2018-1272 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2018-1272" }, "action_statement": "Vulnerability CVE-2018-1272 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T22:02:19.515243+00:00", "status_notes": "Vulnerability CVE-2018-15756 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2018-15756" }, "action_statement": "Vulnerability CVE-2018-15756 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T03:58:30.759519+00:00", "status_notes": "Vulnerability CVE-2020-5397 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2020-5397" }, "action_statement": "Vulnerability CVE-2020-5397 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-5398 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2020-5398" }, "action_statement": "Vulnerability CVE-2020-5398 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2021-22096" }, "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2021-22118 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2021-22118" }, "action_statement": "Vulnerability CVE-2021-22118 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-31T02:50:24.069920+00:00", "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2022-22950. The vulnerability (SpEL expression DoS via large array allocation) was fixed in upstream version 5.3.17 by Sam Brannen. Since 5.3.30 is newer than 5.3.17, the fix was already present in the upstream release when TuxCare onboarded it. The target contains the complete mitigation: MAX_ARRAY_ELEMENTS constant (256K limit), checkNumElements(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22950" }, "impact_statement": "not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2022-22950. The vulnerability (SpEL expression DoS via large array allocation) was fixed in upstream version 5.3.17 by Sam Brannen. Since 5.3.30 is newer than 5.3.17, the fix was already present in the upstream release when TuxCare onboarded it. The target contains the complete mitigation: MAX_ARRAY_ELEMENTS constant (256K limit), checkNumElements(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T09:01:17.494754+00:00", "status_notes": "Vulnerability CVE-2022-22965 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. Spring Framework 5.3.30 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22965" }, "impact_statement": "Spring Framework 5.3.30 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-31T00:42:33.393054+00:00", "status_notes": "Vulnerability CVE-2022-22968 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2022-22968 is NOT present in Spring Framework 5.3.30. The vulnerability involved case-sensitive pattern matching in DataBinder's disallowedFields, allowing attackers to bypass protection by capitalizing field names. The fix was already shipped in the upstream Spring Framework 5.3.30 release (commit a7cf19cec5 by sbrannen@vmware.com) before TuxCare onboarded this version. The target code at ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22968" }, "impact_statement": "not_affected \u2014 CVE-2022-22968 is NOT present in Spring Framework 5.3.30. The vulnerability involved case-sensitive pattern matching in DataBinder's disallowedFields, allowing attackers to bypass protection by capitalizing field names. The fix was already shipped in the upstream Spring Framework 5.3.30 release (commit a7cf19cec5 by sbrannen@vmware.com) before TuxCare onboarded this version. The target code at ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2022-22970 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.3.30 is NOT affected by CVE-2022-22970. The vulnerability involves DoS attacks through resource exhaustion when data binding allows introspection of dangerous read-only properties (like URL.content, AutoCloseable types) that trigger resource allocation. The fix commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by upstream developer Juergen Hoeller (hoellerj@vmware.co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22970" }, "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.30 is NOT affected by CVE-2022-22970. The vulnerability involves DoS attacks through resource exhaustion when data binding allows introspection of dangerous read-only properties (like URL.content, AutoCloseable types) that trigger resource allocation. The fix commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by upstream developer Juergen Hoeller (hoellerj@vmware.co..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2023-20860 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2023-20860" }, "action_statement": "Vulnerability CVE-2023-20860 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-31T03:25:33.224674+00:00", "status_notes": "Vulnerability CVE-2023-20861 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-20861 concerns a DoS vulnerability in Spring Framework's SpEL expression parser caused by lack of shared pattern caching across multiple `matches` operations. The target (Spring Framework 5.3.30) is NOT affected because the upstream fix (commit 430fc25aca by Sam Brannen) was already included in the 5.3.26 release. The CVE states affected versions are 5.3.0-5.3.25; version 5.3.30 inheri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-20861" }, "impact_statement": "not_affected \u2014 CVE-2023-20861 concerns a DoS vulnerability in Spring Framework's SpEL expression parser caused by lack of shared pattern caching across multiple `matches` operations. The target (Spring Framework 5.3.30) is NOT affected because the upstream fix (commit 430fc25aca by Sam Brannen) was already included in the 5.3.26 release. The CVE states affected versions are 5.3.0-5.3.25; version 5.3.30 inheri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-31T01:18:49.870805+00:00", "status_notes": "Vulnerability CVE-2023-20863 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 Target version 5.3.30 is not affected by CVE-2023-20863. The vulnerability fix (SpEL expression length limit of 10,000 characters) was already present in upstream Spring Framework 5.3.27, which was released before this version. The defense code is fully implemented in HEAD, including the MAX_EXPRESSION_LENGTH constant, checkExpressionLength() validation method, and MAX_EXPRESSION_LENGTH_EXCEEDE...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-20863" }, "impact_statement": "not_affected \u2014 Target version 5.3.30 is not affected by CVE-2023-20863. The vulnerability fix (SpEL expression length limit of 10,000 characters) was already present in upstream Spring Framework 5.3.27, which was released before this version. The defense code is fully implemented in HEAD, including the MAX_EXPRESSION_LENGTH constant, checkExpressionLength() validation method, and MAX_EXPRESSION_LENGTH_EXCEEDE..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2023-34053 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2023-34053" }, "action_statement": "Vulnerability CVE-2023-34053 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T03:48:46.502543+00:00", "status_notes": "Vulnerability CVE-2024-22233 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-22233" }, "action_statement": "Vulnerability CVE-2024-22233 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-22243" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-22259" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-22262" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38808" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38809" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38816" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38819" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38820" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38828" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2025-22233" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2025-41234 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2025-41234" }, "action_statement": "Vulnerability CVE-2025-41234 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2025-41242" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2025-41249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-22735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-22737" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-22741" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-22745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41841" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41842" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-15T22:33:00.263051+00:00", "status_notes": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc, and is fixed in 5.3.30-tuxcare.12.", "vulnerability": { "name": "CVE-2026-41843" }, "action_statement": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc, and is fixed in 5.3.30-tuxcare.12." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41844" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41845" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41846" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41848" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41849" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41850" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41851" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41852" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41853" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41854" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T11:15:38.104171+00:00", "status_notes": "Vulnerability CVE-2026-47883 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) was introduced in version 6.2.0 (May 2024) and does not exist in the 5.3.x series. While the target can receive HTTP requests with double leading slashes, no code path exists that would construct protocol-relative URLs in redirect Location headers from request URIs, which is the core vulnerabi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-47883" }, "impact_statement": "not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) was introduced in version 6.2.0 (May 2024) and does not exist in the 5.3.x series. While the target can receive HTTP requests with double leading slashes, no code path exists that would construct protocol-relative URLs in redirect Location headers from request URIs, which is the core vulnerabi..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-47884" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T14:02:30.472061+00:00", "status_notes": "Vulnerability CVE-2026-47885 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 The vulnerable class PartEventHttpMessageReader was introduced in Spring Framework 6.0. The target version 5.3.30 predates this class entirely. Exhaustive searches confirm that neither PartEvent, PartEventHttpMessageReader, nor the maxPartSize property exist in version 5.3.30. The multipart readers present in 5.3.30 (DefaultPartHttpMessageReader, MultipartHttpMessageReader) use a different API ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47885" }, "impact_statement": "not_affected \u2014 The vulnerable class PartEventHttpMessageReader was introduced in Spring Framework 6.0. The target version 5.3.30 predates this class entirely. Exhaustive searches confirm that neither PartEvent, PartEventHttpMessageReader, nor the maxPartSize property exist in version 5.3.30. The multipart readers present in 5.3.30 (DefaultPartHttpMessageReader, MultipartHttpMessageReader) use a different API ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc, and is fixed in 5.3.30-tuxcare.11.", "vulnerability": { "name": "CVE-2026-47886" }, "action_statement": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc, and is fixed in 5.3.30-tuxcare.11." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-47887" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-29T12:31:01.363194+00:00", "status_notes": "Vulnerability CVE-2026-47889 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2026-47889. The vulnerability specifically affects the JettyCoreServerHttpResponse class used with Jetty 12 Core reactive adapter, which does not exist in Spring Framework 5.3.x. This version uses Jetty 9.4.51 with servlet-based adapters that properly serialize the sameSite cookie attribute via ResponseCookie.toString(). Jetty 12 Core support was i...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-47889" }, "impact_statement": "not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2026-47889. The vulnerability specifically affects the JettyCoreServerHttpResponse class used with Jetty 12 Core reactive adapter, which does not exist in Spring Framework 5.3.x. This version uses Jetty 9.4.51 with servlet-based adapters that properly serialize the sameSite cookie attribute via ResponseCookie.toString(). Jetty 12 Core support was i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-10-08T08:18:33.187222+00:00", "status_notes": "Vulnerability CVE-2026-47890 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc. Spring Framework 5.3.30 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when using view fragments, a feature introduced in Spring Framework 6.2.0+ (August 2024). Version 5.3.30 does not have the Fragment API or the vulnerable SSE fragment formatting code. The existing SseEmitter implementation in 5.3.30 already properly escapes line endings (\\r, \\n, \\r\\n) in its writeStringData() method (lines 247-268 of SseEmitter.java), using the same logic as the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47890" }, "impact_statement": "Spring Framework 5.3.30 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when using view fragments, a feature introduced in Spring Framework 6.2.0+ (August 2024). Version 5.3.30 does not have the Fragment API or the vulnerable SSE fragment formatting code. The existing SseEmitter implementation in 5.3.30 already properly escapes line endings (\\r, \\n, \\r\\n) in its writeStringData() method (lines 247-268 of SseEmitter.java), using the same logic as the upstream fix." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-59281" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-59282" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-59283" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-59313" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.30-tuxcare.10" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-59314" } } ] }