{
  "@id": "urn:uuid:72c22029-7c72-44a3-b554-f56220b66681",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:01:00.133094+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2016-10750 does not affect version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast. The target Hazelcast 4.2.8-tuxcare.2 is NOT vulnerable to CVE-2016-10750. The deserialization protection mechanism was already present in upstream Hazelcast 4.2.8, which TuxCare onboarded. The fix adds class name filtering during Java deserialization via SerializationClassNameFilter, which enforces a default whitelist (allowing only \"com.hazelcast.\", \"java\", and \"[\" prefixes) and is active by default. When malicious serialized objects arrive (e.g., in JoinRequest credentials), ObjectInputStream.resolveClass() calls classFilter.filter(name) and throws SecurityException for non-whitelisted classes, preventing arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.11), NVD (< 3.11), Snyk (< 3.10.1; < 3.10.1; < 3.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-10750"
      },
      "impact_statement": "The target Hazelcast 4.2.8-tuxcare.2 is NOT vulnerable to CVE-2016-10750. The deserialization protection mechanism was already present in upstream Hazelcast 4.2.8, which TuxCare onboarded. The fix adds class name filtering during Java deserialization via SerializationClassNameFilter, which enforces a default whitelist (allowing only \"com.hazelcast.\", \"java\", and \"[\" prefixes) and is active by default. When malicious serialized objects arrive (e.g., in JoinRequest credentials), ObjectInputStream.resolveClass() calls classFilter.filter(name) and throws SecurityException for non-whitelisted classes, preventing arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.11), NVD (< 3.11), Snyk (< 3.10.1; < 3.10.1; < 3.10.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-36437 affects version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast.",
      "vulnerability": {
        "name": "CVE-2022-36437"
      },
      "action_statement": "Vulnerability CVE-2022-36437 affects version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-33264 is fixed in version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast.",
      "vulnerability": {
        "name": "CVE-2023-33264"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-33265 is fixed in version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast.",
      "vulnerability": {
        "name": "CVE-2023-33265"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-45859 is fixed in version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast.",
      "vulnerability": {
        "name": "CVE-2023-45859"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T14:56:00.103833+00:00",
      "status_notes": "Vulnerability CVE-2023-45860 affects version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast.",
      "vulnerability": {
        "name": "CVE-2023-45860"
      },
      "action_statement": "Vulnerability CVE-2023-45860 affects version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-08T22:18:00.106306+00:00",
      "status_notes": "Vulnerability CVE-2026-107725 affects version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast.",
      "vulnerability": {
        "name": "CVE-2026-107725"
      },
      "action_statement": "Vulnerability CVE-2026-107725 affects version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-08T22:26:00.087068+00:00",
      "status_notes": "Vulnerability CVE-2026-107726 does not affect version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast. not_affected \u2014 Hazelcast version 4.2.8 is not affected by CVE-2026-107726. The vulnerability is specific to \"zero config Compact serialization,\" a feature introduced in Hazelcast 5.0. Version 4.2.8 does not contain any Compact serialization code, type constants, or configuration. Exhaustive searches for Compact-related classes, serialization type IDs, and references yielded zero results. The target only suppo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-107726"
      },
      "impact_statement": "not_affected \u2014 Hazelcast version 4.2.8 is not affected by CVE-2026-107726. The vulnerability is specific to \"zero config Compact serialization,\" a feature introduced in Hazelcast 5.0. Version 4.2.8 does not contain any Compact serialization code, type constants, or configuration. Exhaustive searches for Compact-related classes, serialization type IDs, and references yielded zero results. The target only suppo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.hazelcast/hazelcast@4.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:13:36.432303+00:00",
      "status_notes": "Vulnerability GHSA-v57x-gxfj-484q affects version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast.",
      "vulnerability": {
        "name": "GHSA-v57x-gxfj-484q"
      },
      "action_statement": "Vulnerability GHSA-v57x-gxfj-484q affects version 4.2.8-tuxcare.2 of com.hazelcast:hazelcast."
    }
  ]
}