{
  "@id": "urn:uuid:f1d732c2-0b0f-4d3a-ba83-2bf77e11f562",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:06:46.571739+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T04:40:00.129258+00:00",
      "status_notes": "Vulnerability CVE-2021-27568 does not affect version 2.5.1-tuxcare.1 of net.minidev:json-smart. not_affected \u2014 CVE-2021-27568 describes uncaught NumberFormatException in json-smart's number parsing that can cause application crashes or information disclosure. The target repository (json-smart 2.5.1-tuxcare.1) is NOT affected because the upstream vendor already fixed this vulnerability before version 2.5.1 was released. The fix (commit c8133d2 by tmayer@it-sec.de, Feb 26 2021) added try-catch blocks arou...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-27568"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-27568 describes uncaught NumberFormatException in json-smart's number parsing that can cause application crashes or information disclosure. The target repository (json-smart 2.5.1-tuxcare.1) is NOT affected because the upstream vendor already fixed this vulnerability before version 2.5.1 was released. The fix (commit c8133d2 by tmayer@it-sec.de, Feb 26 2021) added try-catch blocks arou..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:46.571739+00:00",
      "status_notes": "Vulnerability CVE-2021-31684 does not affect version 2.5.1-tuxcare.1 of net.minidev:json-smart. CVE-2021-31684 is NOT present in json-smart 2.5.1. The vulnerability was an infinite loop bug in JSONParserByteArray.indexOf() where the loop condition incorrectly checked `pos < len` instead of `i < len`. The upstream vendor fixed this in commit 6ecff1c (April 2021) authored by HAPPY <pcy190@126.com>. This fix was already present in upstream version 2.5.1 when TuxCare onboarded it (commit e89298f). The current code at line 81 correctly uses `i < len`, preventing the infinite loop DoS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.3; >= 2.4.0, < 2.4.4), NVD (>= 1.3, < 1.3.3; >= 2.4, < 2.4.4), Snyk (>= 0, < 1.3.3; >= 2.0.0, < 2.4.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-31684"
      },
      "impact_statement": "CVE-2021-31684 is NOT present in json-smart 2.5.1. The vulnerability was an infinite loop bug in JSONParserByteArray.indexOf() where the loop condition incorrectly checked `pos < len` instead of `i < len`. The upstream vendor fixed this in commit 6ecff1c (April 2021) authored by HAPPY <pcy190@126.com>. This fix was already present in upstream version 2.5.1 when TuxCare onboarded it (commit e89298f). The current code at line 81 correctly uses `i < len`, preventing the infinite loop DoS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.3; >= 2.4.0, < 2.4.4), NVD (>= 1.3, < 1.3.3; >= 2.4, < 2.4.4), Snyk (>= 0, < 1.3.3; >= 2.0.0, < 2.4.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:01:20.989527+00:00",
      "status_notes": "Vulnerability CVE-2023-1370 does not affect version 2.5.1-tuxcare.1 of net.minidev:json-smart. The target repository at version 2.5.1 (SHA d10060b) is NOT vulnerable to CVE-2023-1370. The vulnerability (stack overflow from deeply nested JSON) was fixed in upstream version 2.4.9 (March 2023) by adding depth limit enforcement. The fix was already present when TuxCare onboarded version 2.5.1. The vulnerable code pattern (unbounded recursion in readArray/readObject) is not present in HEAD \u2014 it was replaced by depth-checked recursion with MAX_DEPTH=400. The fix is enabled by default via MODE_PERMISSIVE which includes the LIMIT_JSON_DEPTH flag. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.9), NVD (< 2.4.9), cve.org (< 2.4.9), Snyk (< 2.4.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-1370"
      },
      "impact_statement": "The target repository at version 2.5.1 (SHA d10060b) is NOT vulnerable to CVE-2023-1370. The vulnerability (stack overflow from deeply nested JSON) was fixed in upstream version 2.4.9 (March 2023) by adding depth limit enforcement. The fix was already present when TuxCare onboarded version 2.5.1. The vulnerable code pattern (unbounded recursion in readArray/readObject) is not present in HEAD \u2014 it was replaced by depth-checked recursion with MAX_DEPTH=400. The fix is enabled by default via MODE_PERMISSIVE which includes the LIMIT_JSON_DEPTH flag. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.9), NVD (< 2.4.9), cve.org (< 2.4.9), Snyk (< 2.4.9)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-57699 is fixed in version 2.5.1-tuxcare.1 of net.minidev:json-smart.",
      "vulnerability": {
        "name": "CVE-2024-57699"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:50:19.528729+00:00",
      "status_notes": "Vulnerability CVE-2026-113602 affects version 2.5.1-tuxcare.1 of net.minidev:json-smart.",
      "vulnerability": {
        "name": "CVE-2026-113602"
      },
      "action_statement": "Vulnerability CVE-2026-113602 affects version 2.5.1-tuxcare.1 of net.minidev:json-smart."
    }
  ]
}