{
  "@id": "urn:uuid:e8168811-8cca-4be5-a96e-91e50abebeca",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 26,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:00:33.311561+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14775"
      },
      "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:45:11.789246+00:00",
      "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.44.0-p2+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15133"
      },
      "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T11:54:00.052758+00:00",
      "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2019-9081"
      },
      "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:15.621975+00:00",
      "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.44.0-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-19316"
      },
      "impact_statement": "CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:49.287227+00:00",
      "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.44.0-p2+tuxcare of laravel/framework. The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24941"
      },
      "impact_statement": "The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:49.287382+00:00",
      "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.44.0-p2+tuxcare of laravel/framework. Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21263"
      },
      "impact_statement": "Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:25:11.687376+00:00",
      "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43808"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:44:10.208770+00:00",
      "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.44.0-p2+tuxcare of laravel/framework. The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52301"
      },
      "impact_statement": "The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2025-27515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-29T20:20:00.418969+00:00",
      "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-102279"
      },
      "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-114508"
      },
      "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T09:58:59.407356+00:00",
      "status_notes": "Vulnerability CVE-2026-114509 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-114509"
      },
      "action_statement": "Vulnerability CVE-2026-114509 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-13T19:00:33.311561+00:00",
      "status_notes": "Vulnerability CVE-2026-128083 affects version 11.44.0-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2026-128083"
      },
      "action_statement": "Vulnerability CVE-2026-128083 affects version 11.44.0-p2+tuxcare of laravel/framework."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:46:42.693041+00:00",
      "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4mg9-vhxq-vm7j"
      },
      "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-5vg9-5847-vvmq"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T20:58:31.605031+00:00",
      "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6jvx-8ch9-j2jr"
      },
      "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7852-w36x-6mf6"
      },
      "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p2+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-crmm-hgp2-wgrp"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:15:38.790655+00:00",
      "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-jwvj-pwww-3mj5"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:18:00.235397+00:00",
      "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.44.0-p2+tuxcare of laravel/framework. The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-qm5c-m76r-2hfr"
      },
      "impact_statement": "The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wq8p-mqvg-2p5h"
      },
      "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:41:49.287227+00:00",
      "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.44.0-p2+tuxcare of laravel/framework. The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-x7p5-p2c9-phvg"
      },
      "impact_statement": "The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare."
    }
  ]
}