{
  "@id": "urn:uuid:fb16681f-ee6d-48a7-9f07-bb9e6217b049",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:45:13.518225+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-10T15:44:59.861604+00:00",
      "status_notes": "Vulnerability CVE-2022-24894 does not affect version v6.4.38-p1+tuxcare of symfony/http-kernel. not_affected \u2014 The target repository (Symfony http-kernel v6.4.38) is NOT affected by CVE-2022-24894. The vulnerability fix is already present in the codebase. The upstream Symfony v6.4.38 release shipped with the security fix (originally applied in March 2022) that prevents Set-Cookie headers from being stored in the HTTP cache. The TuxCare snapshot commit 92ea54b3 onboarded this already-fixed version. The d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24894"
      },
      "impact_statement": "not_affected \u2014 The target repository (Symfony http-kernel v6.4.38) is NOT affected by CVE-2022-24894. The vulnerability fix is already present in the codebase. The upstream Symfony v6.4.38 release shipped with the security fix (originally applied in March 2022) that prevents Set-Cookie headers from being stored in the HTTP cache. The TuxCare snapshot commit 92ea54b3 onboarded this already-fixed version. The d..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-10T15:45:13.518225+00:00",
      "status_notes": "Vulnerability CVE-2026-123339 is fixed in version v6.4.38-p1+tuxcare of symfony/http-kernel.",
      "vulnerability": {
        "name": "CVE-2026-123339"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-10T15:44:59.861604+00:00",
      "status_notes": "Vulnerability CVE-2026-45075 does not affect version v6.4.38-p1+tuxcare of symfony/http-kernel. The target (symfony/http-kernel v6.4.38) is NOT AFFECTED by CVE-2026-45075. The vulnerable code\u2014the IsSignatureValid attribute with methods filtering\u2014was introduced in v7.4.0 and does not exist in v6.4.38. The CVE describes a HEAD request bypass vulnerability in security attributes (IsGranted, IsCsrfTokenValid, IsSignatureValid) that accept a methods parameter. In symfony/http-kernel, only IsSignatureValid is relevant, and it was added in commit e129d986 (included in v7.4.0 tag). The target predates this feature entirely. No other security attributes with methods filtering exist in v6.4.38 (only CacheAttributeListener exists, which has no methods parameter). This is Rule 5 Type A1: the INPUT (HEAD requests to endpoints protected by IsSignatureValid with methods=['GET']) cannot be received because the IsSignatureValid attribute code is not present in the target codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45075"
      },
      "impact_statement": "The target (symfony/http-kernel v6.4.38) is NOT AFFECTED by CVE-2026-45075. The vulnerable code\u2014the IsSignatureValid attribute with methods filtering\u2014was introduced in v7.4.0 and does not exist in v6.4.38. The CVE describes a HEAD request bypass vulnerability in security attributes (IsGranted, IsCsrfTokenValid, IsSignatureValid) that accept a methods parameter. In symfony/http-kernel, only IsSignatureValid is relevant, and it was added in commit e129d986 (included in v7.4.0 tag). The target predates this feature entirely. No other security attributes with methods filtering exist in v6.4.38 (only CacheAttributeListener exists, which has no methods parameter). This is Rule 5 Type A1: the INPUT (HEAD requests to endpoints protected by IsSignatureValid with methods=['GET']) cannot be received because the IsSignatureValid attribute code is not present in the target codebase."
    }
  ]
}