{
  "@id": "urn:uuid:7edc2265-9dea-4d78-a620-a86417e9181e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T11:59:58.922832+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.code.gson/gson@2.10.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.code.gson/gson@2.10.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:58.922832+00:00",
      "status_notes": "Vulnerability CVE-2022-25647 does not affect version 2.10.1-tuxcare.1 of com.google.code.gson:gson. CVE-2022-25647 affects Gson versions before 2.8.9. The target version 2.10.1 already contains the upstream fix (commit e6fae590) that adds readObject() methods to LazilyParsedNumber and LinkedTreeMap classes, blocking direct deserialization with InvalidObjectException. The fix was shipped in the upstream Gson 2.10.1 release that TuxCare onboarded, not applied by TuxCare as a backport. The vulnerable pattern (missing deserialization protection) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.8.9), NVD (>= 2.2.3, < 2.8.9), cve.org (< 2.8.9), Snyk (>= 2.2.3, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25647"
      },
      "impact_statement": "CVE-2022-25647 affects Gson versions before 2.8.9. The target version 2.10.1 already contains the upstream fix (commit e6fae590) that adds readObject() methods to LazilyParsedNumber and LinkedTreeMap classes, blocking direct deserialization with InvalidObjectException. The fix was shipped in the upstream Gson 2.10.1 release that TuxCare onboarded, not applied by TuxCare as a backport. The vulnerable pattern (missing deserialization protection) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.8.9), NVD (>= 2.2.3, < 2.8.9), cve.org (< 2.8.9), Snyk (>= 2.2.3, < 2.8.9)."
    }
  ]
}