{
  "@id": "urn:uuid:c7331d11-17cb-4f53-bdd0-d2305fe9a5a0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:05:17.011429+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:01.158878+00:00",
      "status_notes": "Vulnerability CVE-2021-22569 does not affect version 3.19.6-tuxcare.1 of com.google.protobuf:protobuf-java. CVE-2021-22569 affects protobuf versions prior to 3.19.2. The target is at version 3.19.6, which already contains the upstream fix. The vulnerability involved excessive short-lived object creation during parsing of unknown fields, causing GC pauses and denial of service. The fix (commit 9638a5e53 by Adam Cozzette) refactored UnknownFieldSet.Builder to defer Field object creation by maintaining Field.Builder objects throughout parsing instead of building Fields prematurely. The fix was present in the upstream 3.19.6 release that TuxCare onboarded, making this an upstream-fixed version, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22569"
      },
      "impact_statement": "CVE-2021-22569 affects protobuf versions prior to 3.19.2. The target is at version 3.19.6, which already contains the upstream fix. The vulnerability involved excessive short-lived object creation during parsing of unknown fields, causing GC pauses and denial of service. The fix (commit 9638a5e53 by Adam Cozzette) refactored UnknownFieldSet.Builder to defer Field object creation by maintaining Field.Builder objects throughout parsing instead of building Fields prematurely. The fix was present in the upstream 3.19.6 release that TuxCare onboarded, making this an upstream-fixed version, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-22570 is a false positive for com.google.protobuf:protobuf-java 3.19.6-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2021-22570"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:01:00.154900+00:00",
      "status_notes": "Vulnerability CVE-2022-3171 does not affect version 3.19.6-tuxcare.1 of com.google.protobuf:protobuf-java. not_affected \u2014 Target version 3.19.6-tuxcare.1 is NOT vulnerable to CVE-2022-3171. The vulnerability (DoS through excessive object allocation during parsing of protobuf data with multiple instances of non-repeated embedded messages) was fixed by upstream Google in the 3.19.6 release dated 2022-09-27. The fix refactors Java parsing to merge data directly into mutable message objects instead of repeatedly creat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-3171"
      },
      "impact_statement": "not_affected \u2014 Target version 3.19.6-tuxcare.1 is NOT vulnerable to CVE-2022-3171. The vulnerability (DoS through excessive object allocation during parsing of protobuf data with multiple instances of non-repeated embedded messages) was fixed by upstream Google in the 3.19.6 release dated 2022-09-27. The fix refactors Java parsing to merge data directly into mutable message objects instead of repeatedly creat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:05:17.011429+00:00",
      "status_notes": "Vulnerability CVE-2022-3509 does not affect version 3.19.6-tuxcare.1 of com.google.protobuf:protobuf-java. The target version 3.19.6-tuxcare.1 is NOT vulnerable to CVE-2022-3509. The fix for this textformat parsing DoS vulnerability was already present in the upstream protobuf 3.19.6 release when TuxCare onboarded it. The vulnerability caused resource exhaustion through repeated mutable\u2194immutable conversions when parsing textformat data with multiple instances of non-repeated embedded message fields. The fix (commit b0e8e607d, \"Refactoring Java parsing (3.19.x)\") was authored by upstream Google developer Mike Kruskal on 2022-09-29 and shipped in the upstream 3.19.6 release, which TuxCare onboarded on 2026-06-01.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (< 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-3509"
      },
      "impact_statement": "The target version 3.19.6-tuxcare.1 is NOT vulnerable to CVE-2022-3509. The fix for this textformat parsing DoS vulnerability was already present in the upstream protobuf 3.19.6 release when TuxCare onboarded it. The vulnerability caused resource exhaustion through repeated mutable\u2194immutable conversions when parsing textformat data with multiple instances of non-repeated embedded message fields. The fix (commit b0e8e607d, \"Refactoring Java parsing (3.19.x)\") was authored by upstream Google developer Mike Kruskal on 2022-09-29 and shipped in the upstream 3.19.6 release, which TuxCare onboarded on 2026-06-01.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (< 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:19.723998+00:00",
      "status_notes": "Vulnerability CVE-2022-3510 does not affect version 3.19.6-tuxcare.1 of com.google.protobuf:protobuf-java. CVE-2022-3510 affects protobuf-java versions prior to 3.19.6. The target version is 3.19.6, which is the first fixed version in the 3.19.x line. The fix was authored by upstream Google engineer Mike Kruskal in commit b0e8e607 (\"Refactoring Java parsing (3.19.x)\") and shipped in the official upstream 3.19.6 release. TuxCare onboarded the already-fixed upstream version in commit 0151633e6. The vulnerable pattern\u2014parsing non-repeated message-type extensions by repeatedly creating new immutable objects\u2014is not present. Instead, ExtensionSchemaLite.java lines 256-300 implement the fix: when parsing non-repeated GROUP/MESSAGE extensions, if an old value exists and is immutable, the code creates a mutable copy once and merges subsequent instances in-place, preventing the back-and-forth conversions that cause GC pauses.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (>= 3.16.0, < 3.16.3; >= 3.19.0-rc-1, < 3.19.6; >= 3.20.0-rc-1, < 3.20.3; >= 3.21.0-rc-1, < 3.21.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-3510"
      },
      "impact_statement": "CVE-2022-3510 affects protobuf-java versions prior to 3.19.6. The target version is 3.19.6, which is the first fixed version in the 3.19.x line. The fix was authored by upstream Google engineer Mike Kruskal in commit b0e8e607 (\"Refactoring Java parsing (3.19.x)\") and shipped in the official upstream 3.19.6 release. TuxCare onboarded the already-fixed upstream version in commit 0151633e6. The vulnerable pattern\u2014parsing non-repeated message-type extensions by repeatedly creating new immutable objects\u2014is not present. Instead, ExtensionSchemaLite.java lines 256-300 implement the fix: when parsing non-repeated GROUP/MESSAGE extensions, if an old value exists and is immutable, the code creates a mutable copy once and merges subsequent instances in-place, preventing the back-and-forth conversions that cause GC pauses.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (>= 3.16.0, < 3.16.3; >= 3.19.0-rc-1, < 3.19.6; >= 3.20.0-rc-1, < 3.20.3; >= 3.21.0-rc-1, < 3.21.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.19.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-7254 is fixed in version 3.19.6-tuxcare.1 of com.google.protobuf:protobuf-java.",
      "vulnerability": {
        "name": "CVE-2024-7254"
      }
    }
  ]
}