{
  "@id": "urn:uuid:adbd755a-c757-4a24-8c7d-5b6e25ae6033",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-21T07:32:07.005141+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-21T07:32:07.005141+00:00",
      "status_notes": "Vulnerability CVE-2024-50345 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-50345"
      },
      "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-21T07:32:07.005141+00:00",
      "status_notes": "Vulnerability CVE-2025-64500 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-64500"
      },
      "impact_statement": "already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-21T07:32:07.005141+00:00",
      "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v6.4.35-p1+tuxcare of symfony/http-foundation.",
      "vulnerability": {
        "name": "CVE-2026-108082"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-21T07:32:07.005141+00:00",
      "status_notes": "Vulnerability CVE-2026-48736 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-48736"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro..."
    }
  ]
}