{
  "@id": "urn:uuid:ff45b6a4-39e1-450a-9ace-63f1430949dd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T03:50:40.921234+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2013-7285 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2013-7285"
      },
      "action_statement": "Vulnerability CVE-2013-7285 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2016-3674 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2016-3674"
      },
      "action_statement": "Vulnerability CVE-2016-3674 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2017-7957 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2017-7957"
      },
      "action_statement": "Vulnerability CVE-2017-7957 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:34:36.358672+00:00",
      "status_notes": "Vulnerability CVE-2020-26217 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2020-26217"
      },
      "action_statement": "Vulnerability CVE-2020-26217 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-26258 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution. already_fixed \u2014 CVE-2020-26258 has already been fixed in the target repository. The vendor patch commit 6740c04b217aef02d44fba26402b35e0f6f493ce is present, adding 'jdk.nashorn.internal.objects.NativeString' to the default blacklist in XStream's security framework. This prevents the Server-Side Request Forgery attack chain described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26258"
      },
      "impact_statement": "already_fixed \u2014 CVE-2020-26258 has already been fixed in the target repository. The vendor patch commit 6740c04b217aef02d44fba26402b35e0f6f493ce is present, adding 'jdk.nashorn.internal.objects.NativeString' to the default blacklist in XStream's security framework. This prevents the Server-Side Request Forgery attack chain described in the CVE."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-26259 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution. already_fixed \u2014 XStream version 1.4.17 already contains a fix for CVE-2020-26259. The target has an even stronger defense than the original 1.4.15 fix: it denies the entire InputStream type hierarchy, which comprehensively blocks ReadAllStream$FileStream and all other malicious InputStream subclasses.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26259"
      },
      "impact_statement": "already_fixed \u2014 XStream version 1.4.17 already contains a fix for CVE-2020-26259. The target has an even stronger defense than the original 1.4.15 fix: it denies the entire InputStream type hierarchy, which comprehensively blocks ReadAllStream$FileStream and all other malicious InputStream subclasses."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:30:41.069534+00:00",
      "status_notes": "Vulnerability CVE-2021-21341 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-21341"
      },
      "action_statement": "Vulnerability CVE-2021-21341 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T03:23:32.263881+00:00",
      "status_notes": "Vulnerability CVE-2021-21342 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution. not_affected \u2014 CVE-2021-21342 describes a Server-Side Forgery Request vulnerability via javax.activation.DataSource instantiation during deserialization. The upstream XStream 1.4.16 release (March 2021) included the fix for this CVE by denying the DataSource type hierarchy in its blacklist-based security. When TuxCare onboarded upstream XStream 1.4.17 (released May 2021), this fix was already present. Subsequ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21342"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21342 describes a Server-Side Forgery Request vulnerability via javax.activation.DataSource instantiation during deserialization. The upstream XStream 1.4.16 release (March 2021) included the fix for this CVE by denying the DataSource type hierarchy in its blacklist-based security. When TuxCare onboarded upstream XStream 1.4.17 (released May 2021), this fix was already present. Subsequ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T03:50:40.921234+00:00",
      "status_notes": "Vulnerability CVE-2021-21343 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution. not_affected \u2014 CVE-2021-21343 is not present in XStream 1.4.17-tuxcare.2. The vulnerability allows attackers to manipulate XML input to deserialize InputStream objects with corrupted internal state, potentially causing file deletion or other malicious behavior. The upstream fix (commit d5e51177 by joerg.schaible@gmx.de, dated March 9, 2021) added `denyTypeHierarchy(InputStream.class)` to block all InputStream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21343"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21343 is not present in XStream 1.4.17-tuxcare.2. The vulnerability allows attackers to manipulate XML input to deserialize InputStream objects with corrupted internal state, potentially causing file deletion or other malicious behavior. The upstream fix (commit d5e51177 by joerg.schaible@gmx.de, dated March 9, 2021) added `denyTypeHierarchy(InputStream.class)` to block all InputStream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T16:57:00.115125+00:00",
      "status_notes": "Vulnerability CVE-2021-21344 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution. not_affected \u2014 CVE-2021-21344 allows remote code execution via XStream deserialization of InputStream objects with attacker-controlled internal state (e.g., ByteArrayInputStream with pos=-2147483648 causing endless reads). The vulnerability affects XStream versions before 1.4.16. The target is version 1.4.17-tuxcare.2, which inherited the upstream fix from version 1.4.17. The fix (commit d5e51177 by joerg.sch...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21344"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21344 allows remote code execution via XStream deserialization of InputStream objects with attacker-controlled internal state (e.g., ByteArrayInputStream with pos=-2147483648 causing endless reads). The vulnerability affects XStream versions before 1.4.16. The target is version 1.4.17-tuxcare.2, which inherited the upstream fix from version 1.4.17. The fix (commit d5e51177 by joerg.sch..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:20:00.213522+00:00",
      "status_notes": "Vulnerability CVE-2021-21345 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution. not_affected \u2014 CVE-2021-21345 affects XStream versions using the default blacklist security model, allowing deserialization of ByteArrayInputStream with manipulated fields (pos=-2147483648) causing resource exhaustion through endless zero-byte reads. The target repository (xstream 1.4.17-tuxcare.2) is NOT affected because the upstream fix was already present in the 1.4.17 release that TuxCare onboarded. The o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21345"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21345 affects XStream versions using the default blacklist security model, allowing deserialization of ByteArrayInputStream with manipulated fields (pos=-2147483648) causing resource exhaustion through endless zero-byte reads. The target repository (xstream 1.4.17-tuxcare.2) is NOT affected because the upstream fix was already present in the 1.4.17 release that TuxCare onboarded. The o..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:48:07.176896+00:00",
      "status_notes": "Vulnerability CVE-2021-21346 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-21346"
      },
      "action_statement": "Vulnerability CVE-2021-21346 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T00:14:49.554068+00:00",
      "status_notes": "Vulnerability CVE-2021-21347 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution. not_affected \u2014 Target XStream 1.4.17 is not affected by CVE-2021-21347. The vulnerability affects versions up to 1.4.15, and the fix was included in upstream version 1.4.16 (commit d5e51177 by Joerg Schaible). The TuxCare-onboarded 1.4.17 release inherited this fix. Additionally, TuxCare later backported CVE-2021-39146 which replaced the blacklist security model with a more secure whitelist approach that also...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21347"
      },
      "impact_statement": "not_affected \u2014 Target XStream 1.4.17 is not affected by CVE-2021-21347. The vulnerability affects versions up to 1.4.15, and the fix was included in upstream version 1.4.16 (commit d5e51177 by Joerg Schaible). The TuxCare-onboarded 1.4.17 release inherited this fix. Additionally, TuxCare later backported CVE-2021-39146 which replaced the blacklist security model with a more secure whitelist approach that also..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:45:22.088279+00:00",
      "status_notes": "Vulnerability CVE-2021-21348 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-21348"
      },
      "action_statement": "Vulnerability CVE-2021-21348 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:21:30.903888+00:00",
      "status_notes": "Vulnerability CVE-2021-21349 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution. not_affected \u2014 CVE-2021-21349 (Server-Side Forgery Request via InputStream deserialization) is not present in XStream 1.4.17-tuxcare.2. The vulnerability affected versions up to 1.4.15 and was fixed in upstream version 1.4.16. The target was onboarded from upstream 1.4.17, which already contained the fix authored by joerg.schaible@gmx.de in commit d5e51177634afea7213b9dc2d21f101d2e258db9. The vulnerable patte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21349"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21349 (Server-Side Forgery Request via InputStream deserialization) is not present in XStream 1.4.17-tuxcare.2. The vulnerability affected versions up to 1.4.15 and was fixed in upstream version 1.4.16. The target was onboarded from upstream 1.4.17, which already contained the fix authored by joerg.schaible@gmx.de in commit d5e51177634afea7213b9dc2d21f101d2e258db9. The vulnerable patte..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2021-21350 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-21350"
      },
      "action_statement": "Vulnerability CVE-2021-21350 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:45:22.088279+00:00",
      "status_notes": "Vulnerability CVE-2021-21351 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-21351"
      },
      "action_statement": "Vulnerability CVE-2021-21351 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2021-29505 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-29505"
      },
      "action_statement": "Vulnerability CVE-2021-29505 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39139 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39139"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39140 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39140"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39141 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39141"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39144 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39144"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39145 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39145"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39146 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39146"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39147 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39147"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39148 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39148"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39149 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39149"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39150 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39150"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39151 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39151"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39152 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39152"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39153 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39153"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39154 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-39154"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-43859 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2021-43859"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-40151 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2022-40151"
      },
      "action_statement": "Vulnerability CVE-2022-40151 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2022-40152 is a false positive for com.thoughtworks.xstream:xstream-distribution 1.4.17-tuxcare.2. direct vulnerability is in Woodstox project",
      "vulnerability": {
        "name": "CVE-2022-40152"
      },
      "impact_statement": "direct vulnerability is in Woodstox project"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-41966 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2022-41966"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-47072 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream-distribution.",
      "vulnerability": {
        "name": "CVE-2024-47072"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream-distribution@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability GHSA-3mq5-fq9h-gj7j is a false positive for com.thoughtworks.xstream:xstream-distribution 1.4.17-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-3mq5-fq9h-gj7j"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}