{
  "@id": "urn:uuid:b0a9dd79-6092-4689-bf15-fcd140d8b4dd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T10:21:18.524281+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2018-14773 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14773"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2019-10913 affects version 2.8.52-p1+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2019-10913"
      },
      "action_statement": "Vulnerability CVE-2019-10913 affects version 2.8.52-p1+tuxcare of symfony/http-foundation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2019-18888 affects version 2.8.52-p1+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2019-18888"
      },
      "action_statement": "Vulnerability CVE-2019-18888 affects version 2.8.52-p1+tuxcare of symfony/http-foundation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50345 affects version 2.8.52-p1+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p2+tuxcare.",
      "vulnerability": {
        "name": "CVE-2024-50345"
      },
      "action_statement": "Vulnerability CVE-2024-50345 affects version 2.8.52-p1+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p2+tuxcare."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 2.8.52-p1+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2025-64500"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability CVE-2026-108082 affects version 2.8.52-p1+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2026-108082"
      },
      "action_statement": "Vulnerability CVE-2026-108082 affects version 2.8.52-p1+tuxcare of symfony/http-foundation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-48736 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48736"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def..."
    }
  ]
}