{
  "@id": "urn:uuid:2f2f5745-9ce4-47ed-b2af-6e01ee43b351",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:04:03.421384+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:04:03.421384+00:00",
      "status_notes": "Vulnerability CVE-2021-22569 does not affect version 3.19.2-tuxcare.1 of com.google.protobuf:protobuf-java. Target version 3.19.2-tuxcare.1 is NOT affected by CVE-2021-22569. The vulnerable code pattern (repeated Field object allocation during unknown field parsing) is not present. The target contains the upstream vendor fix that was already included in the protobuf 3.19.2 release. The fix uses TreeMap<Integer, Field.Builder> to reuse Field.Builder instances instead of the vulnerable lastField pattern that created excessive short-lived objects causing GC thrashing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22569"
      },
      "impact_statement": "Target version 3.19.2-tuxcare.1 is NOT affected by CVE-2021-22569. The vulnerable code pattern (repeated Field object allocation during unknown field parsing) is not present. The target contains the upstream vendor fix that was already included in the protobuf 3.19.2 release. The fix uses TreeMap<Integer, Field.Builder> to reuse Field.Builder instances instead of the vulnerable lastField pattern that created excessive short-lived objects causing GC thrashing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-22570 is a false positive for com.google.protobuf:protobuf-java 3.19.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2021-22570"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T07:41:42.516177+00:00",
      "status_notes": "Vulnerability CVE-2022-3171 affects version 3.19.2-tuxcare.1 of com.google.protobuf:protobuf-java.",
      "vulnerability": {
        "name": "CVE-2022-3171"
      },
      "action_statement": "Vulnerability CVE-2022-3171 affects version 3.19.2-tuxcare.1 of com.google.protobuf:protobuf-java."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T07:42:43.318871+00:00",
      "status_notes": "Vulnerability CVE-2022-3509 is fixed in version 3.19.2-tuxcare.1 of com.google.protobuf:protobuf-java.",
      "vulnerability": {
        "name": "CVE-2022-3509"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T07:41:42.516177+00:00",
      "status_notes": "Vulnerability CVE-2022-3510 affects version 3.19.2-tuxcare.1 of com.google.protobuf:protobuf-java.",
      "vulnerability": {
        "name": "CVE-2022-3510"
      },
      "action_statement": "Vulnerability CVE-2022-3510 affects version 3.19.2-tuxcare.1 of com.google.protobuf:protobuf-java."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T07:42:43.318871+00:00",
      "status_notes": "Vulnerability CVE-2024-7254 is fixed in version 3.19.2-tuxcare.1 of com.google.protobuf:protobuf-java.",
      "vulnerability": {
        "name": "CVE-2024-7254"
      }
    }
  ]
}