{
  "@id": "urn:uuid:8e09ad21-c886-446c-8214-9a2c287048b2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T10:21:18.524281+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2018-14773 does not affect version 4.4.49-p3+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14773"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2019-10913 affects version 4.4.49-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2019-10913"
      },
      "action_statement": "Vulnerability CVE-2019-10913 affects version 4.4.49-p3+tuxcare of symfony/http-foundation."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2019-18888 affects version 4.4.49-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2019-18888"
      },
      "action_statement": "Vulnerability CVE-2019-18888 affects version 4.4.49-p3+tuxcare of symfony/http-foundation."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:45:05.425663+00:00",
      "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2024-50345"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:45:05.425663+00:00",
      "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2025-64500"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T20:45:05.425663+00:00",
      "status_notes": "Vulnerability CVE-2026-108082 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2026-108082"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-48736 does not affect version 4.4.49-p3+tuxcare of symfony/http-foundation. not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48736"
      },
      "impact_statement": "not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo..."
    }
  ]
}