{ "@id": "urn:uuid:4ed68db5-c984-4a97-9f99-5ea576dbbd21", "role": "Document Creator", "author": "https://tuxcare.com", "version": 28, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:08:16.960631+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.51.0-p2+tuxcare of laravel/framework. The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 11.51.0-p2+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.51.0-p2+tuxcare of laravel/framework. CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.51.0-p2+tuxcare of laravel/framework. CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.51.0-p2+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.51.0-p2+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.51.0-p2+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.51.0-p2+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-11-13T19:08:16.960631+00:00", "status_notes": "Vulnerability CVE-2026-128083 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 ProcessDriver has the unauthenticated-envelope flaw: it json_decodes the child's whole stdout and unserializes 'result' with no HMAC. The upstream fix (c37133b89b, 13.x) is not in HEAD. The CVE's exploit chain (forged JSON followed by \\x1f\\x8b) cannot be completed here. The gzip-magic truncation (#59224) that lets a forged document be accepted with trailing bytes is absent. The ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-128083" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 ProcessDriver has the unauthenticated-envelope flaw: it json_decodes the child's whole stdout and unserializes 'result' with no HMAC. The upstream fix (c37133b89b, 13.x) is not in HEAD. The CVE's exploit chain (forged JSON followed by \\x1f\\x8b) cannot be completed here. The gzip-magic truncation (#59224) that lets a forged document be accepted with trailing bytes is absent. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.51.0-p2+tuxcare of laravel/framework. Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.51.0-p2+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:04.797220+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.51.0-p2+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version." } ] }