{
  "@id": "urn:uuid:dc6ad7f3-2948-4461-a1b1-b8fd6be1fdf5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T11:58:00.062525+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.avro/avro@1.11.3-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.avro/avro@1.11.3-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T11:58:00.062525+00:00",
      "status_notes": "Vulnerability CVE-2023-39410 does not affect version 1.11.3-tuxcare.8 of org.apache.avro:avro. CVE-2023-39410 affects Apache Avro Java SDK up to and including version 1.11.2. The target repository is at version 1.11.3, which includes the upstream fix (commit e2e57aac2) that shipped in the official 1.11.3 release. The fix introduces a centralized SystemLimitException class with validation methods (checkMaxBytesLength, checkMaxStringLength, checkMaxCollectionLength) that prevent unbounded memory allocation during deserialization. All critical deserialization paths in BinaryDecoder now validate length values before allocating memory, rejecting negative values, values exceeding VM limits, and values exceeding configurable system property limits. This is an upstream fix by ryan@skraba.com, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.11.3), NVD (< 1.11.3), cve.org (< 1.11.3; < 1.11.3), Snyk (< 1.11.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-39410"
      },
      "impact_statement": "CVE-2023-39410 affects Apache Avro Java SDK up to and including version 1.11.2. The target repository is at version 1.11.3, which includes the upstream fix (commit e2e57aac2) that shipped in the official 1.11.3 release. The fix introduces a centralized SystemLimitException class with validation methods (checkMaxBytesLength, checkMaxStringLength, checkMaxCollectionLength) that prevent unbounded memory allocation during deserialization. All critical deserialization paths in BinaryDecoder now validate length values before allocating memory, rejecting negative values, values exceeding VM limits, and values exceeding configurable system property limits. This is an upstream fix by ryan@skraba.com, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.11.3), NVD (< 1.11.3), cve.org (< 1.11.3; < 1.11.3), Snyk (< 1.11.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.avro/avro@1.11.3-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.avro/avro@1.11.3-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability CVE-2024-47561 is fixed in version 1.11.3-tuxcare.8 of org.apache.avro:avro.",
      "vulnerability": {
        "name": "CVE-2024-47561"
      }
    }
  ]
}