{
  "@id": "urn:uuid:c2fa4448-c4b9-48ca-8799-83c50c80d43f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:44:00.062264+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-10T15:43:32.053580+00:00",
      "status_notes": "Vulnerability CVE-2022-24894 does not affect version v5.4.51-p1+tuxcare of symfony/http-kernel. not_affected \u2014 The target repository (symfony/http-kernel v5.4.51) is not affected by CVE-2022-24894. The vulnerability involves the HTTP cache system storing and returning Set-Cookie headers to unauthorized clients, potentially allowing session hijacking. The fix, which removes private headers (specifically Set-Cookie by default) before caching responses, was implemented by Nicolas Grekas in upstream commit ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24894"
      },
      "impact_statement": "not_affected \u2014 The target repository (symfony/http-kernel v5.4.51) is not affected by CVE-2022-24894. The vulnerability involves the HTTP cache system storing and returning Set-Cookie headers to unauthorized clients, potentially allowing session hijacking. The fix, which removes private headers (specifically Set-Cookie by default) before caching responses, was implemented by Nicolas Grekas in upstream commit ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-10T15:44:00.062264+00:00",
      "status_notes": "Vulnerability CVE-2026-123339 is fixed in version v5.4.51-p1+tuxcare of symfony/http-kernel.",
      "vulnerability": {
        "name": "CVE-2026-123339"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-10T15:43:32.053580+00:00",
      "status_notes": "Vulnerability CVE-2026-45075 does not affect version v5.4.51-p1+tuxcare of symfony/http-kernel. The target symfony/http-kernel v5.4.51 is NOT AFFECTED by CVE-2026-45075. This vulnerability concerns the `#[IsSignatureValid]` attribute allowing HEAD requests to bypass method-filtered security checks. However, this attribute does not exist in v5.4.51 - it was introduced in Symfony 7.4.0. Exhaustive searches confirmed no trace of IsSignatureValid, IsGranted, or IsCsrfTokenValid attributes in the target. The vulnerable code pattern cannot exist when the feature itself is absent. This is Rule 5 Type A1: the Input (HTTP HEAD requests to controllers protected by these attributes) cannot occur because the attributes don't exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45075"
      },
      "impact_statement": "The target symfony/http-kernel v5.4.51 is NOT AFFECTED by CVE-2026-45075. This vulnerability concerns the `#[IsSignatureValid]` attribute allowing HEAD requests to bypass method-filtered security checks. However, this attribute does not exist in v5.4.51 - it was introduced in Symfony 7.4.0. Exhaustive searches confirmed no trace of IsSignatureValid, IsGranted, or IsCsrfTokenValid attributes in the target. The vulnerable code pattern cannot exist when the feature itself is absent. This is Rule 5 Type A1: the Input (HTTP HEAD requests to controllers protected by these attributes) cannot occur because the attributes don't exist in this version."
    }
  ]
}