{
  "@id": "urn:uuid:d7ef7177-446f-4820-831b-4bce4255db74",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T10:21:18.524281+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2018-14773 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-14773. The vulnerable code pattern (X_ORIGINAL_URL and X_REWRITE_URL header processing in prepareRequestUri()) is not present. The fix was applied in upstream Symfony v3.4.14 by Nicolas Grekas, and TuxCare onboarded v3.4.47 which already included this fix. The CHANGELOG confirms the BC BREAK removal of IIS-only X_ORIGINAL_URL and X_REWRITE_URL h...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14773"
      },
      "impact_statement": "not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-14773. The vulnerable code pattern (X_ORIGINAL_URL and X_REWRITE_URL header processing in prepareRequestUri()) is not present. The fix was applied in upstream Symfony v3.4.14 by Nicolas Grekas, and TuxCare onboarded v3.4.47 which already included this fix. The CHANGELOG confirms the BC BREAK removal of IIS-only X_ORIGINAL_URL and X_REWRITE_URL h..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2019-10913 affects version 3.4.47-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2019-10913"
      },
      "action_statement": "Vulnerability CVE-2019-10913 affects version 3.4.47-p3+tuxcare of symfony/http-foundation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2019-18888 affects version 3.4.47-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2019-18888"
      },
      "action_statement": "Vulnerability CVE-2019-18888 affects version 3.4.47-p3+tuxcare of symfony/http-foundation."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 3.4.47-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2024-50345"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 3.4.47-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2025-64500"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability CVE-2026-108082 affects version 3.4.47-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2026-108082"
      },
      "action_statement": "Vulnerability CVE-2026-108082 affects version 3.4.47-p3+tuxcare of symfony/http-foundation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-48736 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. not_affected \u2014 Target version 3.4.47 is not affected by CVE-2026-48736. The vulnerability requires PRIVATE_SUBNETS constant and isPrivateIp() method for blocking requests to private networks via IPv6 transition forms, but these components were introduced in Symfony 5.4-6.4+ (years later, in 2023-2024). Version 3.4.47 lacks the architectural features required for this vulnerability pattern to exist.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48736"
      },
      "impact_statement": "not_affected \u2014 Target version 3.4.47 is not affected by CVE-2026-48736. The vulnerability requires PRIVATE_SUBNETS constant and isPrivateIp() method for blocking requests to private networks via IPv6 transition forms, but these components were introduced in Symfony 5.4-6.4+ (years later, in 2023-2024). Version 3.4.47 lacks the architectural features required for this vulnerability pattern to exist."
    }
  ]
}