{ "@id": "urn:uuid:2b9bb3d1-36df-4058-a804-7de33ad89ae3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:07:00.085664+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p2+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.5.50-p2+tuxcare of laravel/framework. CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43617" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p2+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p2+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-11-13T19:07:00.085664+00:00", "status_notes": "Vulnerability CVE-2026-128083 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Target is laravel/framework 5.5.50 (TuxCare build). The CVE concerns the Illuminate\\Concurrency component (Concurrency::run() and its process driver), which did not exist until much later releases (11.x/12.x). The component is absent from this tree, and no code here reads a child process's stdout and deserializes it as an internal result. Type A1: the Brief's input channel is not received anywh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-128083" }, "impact_statement": "not_affected \u2014 Target is laravel/framework 5.5.50 (TuxCare build). The CVE concerns the Illuminate\\Concurrency component (Concurrency::run() and its process driver), which did not exist until much later releases (11.x/12.x). The component is absent from this tree, and no code here reads a child process's stdout and deserializes it as an internal result. Type A1: the Brief's input channel is not received anywh..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p2+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } } ] }