{
  "@id": "urn:uuid:59e254c4-97a2-4a53-bd64-07d6a21a4d7c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:06:46.571739+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:05.431502+00:00",
      "status_notes": "Vulnerability CVE-2021-22569 does not affect version 3.21.7-tuxcare.1 of com.google.protobuf:protobuf-java. CVE-2021-22569 affects protobuf-java versions prior to 3.16.1, 3.18.2, and 3.19.2 through a performance DoS in unknown field parsing. The target repository is protobuf version 3.21.7, which is newer than all fixed versions. Analysis confirms the fix (TreeMap-based persistent field builders replacing the vulnerable last-field-caching pattern) is present and was shipped in the upstream 3.21.7 release via commit 9638a5e5315bf73f5e7148c16181676372321892 by Google engineer Adam Cozzette, prior to TuxCare's onboarding of this version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22569"
      },
      "impact_statement": "CVE-2021-22569 affects protobuf-java versions prior to 3.16.1, 3.18.2, and 3.19.2 through a performance DoS in unknown field parsing. The target repository is protobuf version 3.21.7, which is newer than all fixed versions. Analysis confirms the fix (TreeMap-based persistent field builders replacing the vulnerable last-field-caching pattern) is present and was shipped in the upstream 3.21.7 release via commit 9638a5e5315bf73f5e7148c16181676372321892 by Google engineer Adam Cozzette, prior to TuxCare's onboarding of this version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-22570 is a false positive for com.google.protobuf:protobuf-java 3.21.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2021-22570"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:03:00.214454+00:00",
      "status_notes": "Vulnerability CVE-2022-3171 does not affect version 3.21.7-tuxcare.1 of com.google.protobuf:protobuf-java. not_affected \u2014 CVE-2022-3171 DoS vulnerability pattern is NOT present in target protobuf-java 3.21.7-tuxcare.2. The vulnerable parsing pattern (repeatedly creating new immutable message instances and merging them, causing allocation amplification and GC pauses) was removed by upstream vendor fix commit 3b5301c11 dated 2022-09-28, which shipped in protobuf 3.21.7 release. The fix refactored Java parsing to reu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-3171"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-3171 DoS vulnerability pattern is NOT present in target protobuf-java 3.21.7-tuxcare.2. The vulnerable parsing pattern (repeatedly creating new immutable message instances and merging them, causing allocation amplification and GC pauses) was removed by upstream vendor fix commit 3b5301c11 dated 2022-09-28, which shipped in protobuf 3.21.7 release. The fix refactored Java parsing to reu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:46.571739+00:00",
      "status_notes": "Vulnerability CVE-2022-3509 does not affect version 3.21.7-tuxcare.1 of com.google.protobuf:protobuf-java. CVE-2022-3509 is not present in protobuf 3.21.7-tuxcare.2. The CVE affects versions prior to 3.21.7, and the upstream fix (commit a3888f533 by Mike Kruskal) was already included in the upstream 3.21.7 release that TuxCare onboarded. All three MergeTarget implementations (BuilderAdapter, ExtensionAdapter, ExtensionBuilderAdapter) contain the fix that eliminates mutable\u2194immutable object conversion cycles when parsing text-format protobuf data with recurring non-repeated embedded messages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (< 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-3509"
      },
      "impact_statement": "CVE-2022-3509 is not present in protobuf 3.21.7-tuxcare.2. The CVE affects versions prior to 3.21.7, and the upstream fix (commit a3888f533 by Mike Kruskal) was already included in the upstream 3.21.7 release that TuxCare onboarded. All three MergeTarget implementations (BuilderAdapter, ExtensionAdapter, ExtensionBuilderAdapter) contain the fix that eliminates mutable\u2194immutable object conversion cycles when parsing text-format protobuf data with recurring non-repeated embedded messages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (< 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:00:45.012229+00:00",
      "status_notes": "Vulnerability CVE-2022-3510 does not affect version 3.21.7-tuxcare.1 of com.google.protobuf:protobuf-java. Target protobuf-java 3.21.7 is NOT AFFECTED. The vulnerability pattern (excessive object allocation during parsing of multiple instances of non-repeated message-type extension fields) was removed by upstream security patches that shipped in the 3.21.7 release. Commits 3b5301c11 and a3888f53 (authored by Google upstream developer Mike Kruskal) introduced defensive parsing logic that merges wire-format data directly into existing mutable message objects instead of creating new instances and converting between mutable/immutable forms. These fixes were already present in the upstream 3.21.7 release that TuxCare onboarded (commit 4a1341e53).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (>= 3.16.0, < 3.16.3; >= 3.19.0-rc-1, < 3.19.6; >= 3.20.0-rc-1, < 3.20.3; >= 3.21.0-rc-1, < 3.21.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-3510"
      },
      "impact_statement": "Target protobuf-java 3.21.7 is NOT AFFECTED. The vulnerability pattern (excessive object allocation during parsing of multiple instances of non-repeated message-type extension fields) was removed by upstream security patches that shipped in the 3.21.7 release. Commits 3b5301c11 and a3888f53 (authored by Google upstream developer Mike Kruskal) introduced defensive parsing logic that merges wire-format data directly into existing mutable message objects instead of creating new instances and converting between mutable/immutable forms. These fixes were already present in the upstream 3.21.7 release that TuxCare onboarded (commit 4a1341e53).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (>= 3.16.0, < 3.16.3; >= 3.19.0-rc-1, < 3.19.6; >= 3.20.0-rc-1, < 3.20.3; >= 3.21.0-rc-1, < 3.21.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T07:42:43.318871+00:00",
      "status_notes": "Vulnerability CVE-2024-7254 is fixed in version 3.21.7-tuxcare.1 of com.google.protobuf:protobuf-java.",
      "vulnerability": {
        "name": "CVE-2024-7254"
      }
    }
  ]
}