{
  "@id": "urn:uuid:5feea1c9-6829-4fe5-b335-c5118a2a38a7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:00:45.012229+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.code.gson/gson@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.code.gson/gson@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:00:45.012229+00:00",
      "status_notes": "Vulnerability CVE-2022-25647 does not affect version 2.11.0-tuxcare.1 of com.google.code.gson:gson. CVE-2022-25647 is NOT present in Gson 2.11.0. The vulnerability concerns Java deserialization of three internal classes (LazilyParsedNumber, LinkedTreeMap, LinkedHashTreeMap) that could lead to DoS. The upstream Google Gson project fixed this in commit e6fae590 by adding readObject() methods that throw InvalidObjectException. This fix was already present in the upstream 2.11.0 release that TuxCare onboarded. LazilyParsedNumber and LinkedTreeMap both contain the defensive readObject() methods. LinkedHashTreeMap was fixed and then deleted by upstream before 2.11.0. The fix is attributed to upstream author Marcono1234, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.8.9), NVD (>= 2.2.3, < 2.8.9), cve.org (< 2.8.9), Snyk (>= 2.2.3, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25647"
      },
      "impact_statement": "CVE-2022-25647 is NOT present in Gson 2.11.0. The vulnerability concerns Java deserialization of three internal classes (LazilyParsedNumber, LinkedTreeMap, LinkedHashTreeMap) that could lead to DoS. The upstream Google Gson project fixed this in commit e6fae590 by adding readObject() methods that throw InvalidObjectException. This fix was already present in the upstream 2.11.0 release that TuxCare onboarded. LazilyParsedNumber and LinkedTreeMap both contain the defensive readObject() methods. LinkedHashTreeMap was fixed and then deleted by upstream before 2.11.0. The fix is attributed to upstream author Marcono1234, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.8.9), NVD (>= 2.2.3, < 2.8.9), cve.org (< 2.8.9), Snyk (>= 2.2.3, < 2.8.9)."
    }
  ]
}