{
  "@id": "urn:uuid:6ae721cd-0c3c-4f5a-b18b-f81fce5e3bc5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T01:50:17.417044+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T01:50:17.417044+00:00",
      "status_notes": "Vulnerability CVE-2015-3154 is a false positive for zendframework/zend-http 2.5.6-p1+tuxcare. false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail.",
      "vulnerability": {
        "name": "CVE-2015-3154"
      },
      "impact_statement": "false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.5.6-p1+tuxcare of zendframework/zend-http.",
      "vulnerability": {
        "name": "CVE-2021-3007"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-cg8w-5jrc-675g affects version 2.5.6-p1+tuxcare of zendframework/zend-http, and is fixed in 2.5.6-p2+tuxcare.",
      "vulnerability": {
        "name": "GHSA-cg8w-5jrc-675g"
      },
      "action_statement": "Vulnerability GHSA-cg8w-5jrc-675g affects version 2.5.6-p1+tuxcare of zendframework/zend-http, and is fixed in 2.5.6-p2+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-f6p5-76fp-m248 does not affect version 2.5.6-p1+tuxcare of zendframework/zend-http. already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-f6p5-76fp-m248"
      },
      "impact_statement": "already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch."
    }
  ]
}