{
  "@id": "urn:uuid:1e281159-6001-4e2d-b0de-0c6f52fbbb0d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-28T20:23:28.883016+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:23:28.883016+00:00",
      "status_notes": "Vulnerability CVE-2022-24894 does not affect version v7.4.10-p1+tuxcare of symfony/http-kernel. not_affected \u2014 CVE-2022-24894 is not present in symfony/http-kernel v7.4.10-p1+tuxcare. The vulnerability (HTTP cache storing and serving Set-Cookie headers to unintended clients) was fixed in upstream Symfony versions 4.4.48, 5.4.20, and 6.0.20 (released March 2022). The target version 7.4.10 is much newer and includes the complete upstream fix: Store constructor accepts a private_headers option (defaulting ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24894"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24894 is not present in symfony/http-kernel v7.4.10-p1+tuxcare. The vulnerability (HTTP cache storing and serving Set-Cookie headers to unintended clients) was fixed in upstream Symfony versions 4.4.48, 5.4.20, and 6.0.20 (released March 2022). The target version 7.4.10 is much newer and includes the complete upstream fix: Store constructor accepts a private_headers option (defaulting ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45075 is fixed in version v7.4.10-p1+tuxcare of symfony/http-kernel.",
      "vulnerability": {
        "name": "CVE-2026-45075"
      }
    }
  ]
}