{
  "@id": "urn:uuid:8986e522-c25e-4b0e-8f4a-99ba1dfd9cf6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T11:02:00.186798+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-javalite@3.21.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-javalite@3.21.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T11:02:00.186798+00:00",
      "status_notes": "Vulnerability CVE-2022-3171 does not affect version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-javalite. not_affected \u2014 CVE-2022-3171 is NOT present in protobuf 3.21.12. The vulnerability was fixed in upstream protobuf 3.21.7 (commit 3b5301c114 \"Refactoring Java parsing\"), which refactored the parsing logic to merge directly into mutable message objects instead of repeatedly creating and converting between mutable and immutable forms. Since the target is version 3.21.12 (onboarded from upstream after 3.21.7), it...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-3171"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-3171 is NOT present in protobuf 3.21.12. The vulnerability was fixed in upstream protobuf 3.21.7 (commit 3b5301c114 \"Refactoring Java parsing\"), which refactored the parsing logic to merge directly into mutable message objects instead of repeatedly creating and converting between mutable and immutable forms. Since the target is version 3.21.12 (onboarded from upstream after 3.21.7), it..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-javalite@3.21.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-javalite@3.21.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2022-3509 affects version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-javalite.",
      "vulnerability": {
        "name": "CVE-2022-3509"
      },
      "action_statement": "Vulnerability CVE-2022-3509 affects version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-javalite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-javalite@3.21.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-javalite@3.21.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:10:11.880828+00:00",
      "status_notes": "Vulnerability CVE-2022-3510 affects version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-javalite.",
      "vulnerability": {
        "name": "CVE-2022-3510"
      },
      "action_statement": "Vulnerability CVE-2022-3510 affects version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-javalite."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-javalite@3.21.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-javalite@3.21.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T21:57:49.648322+00:00",
      "status_notes": "Vulnerability CVE-2024-7254 is fixed in version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-javalite.",
      "vulnerability": {
        "name": "CVE-2024-7254"
      }
    }
  ]
}