{
  "@id": "urn:uuid:be13a1d6-1144-4133-b444-13d74a789a1f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-26T11:34:52.577982+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability CVE-2026-114094 affects version 0.21.7.post2+tuxcare of dulwich.",
      "vulnerability": {
        "name": "CVE-2026-114094"
      },
      "action_statement": "Vulnerability CVE-2026-114094 affects version 0.21.7.post2+tuxcare of dulwich."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability CVE-2026-114095 affects version 0.21.7.post2+tuxcare of dulwich.",
      "vulnerability": {
        "name": "CVE-2026-114095"
      },
      "action_statement": "Vulnerability CVE-2026-114095 affects version 0.21.7.post2+tuxcare of dulwich."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.21.7.post2+tuxcare of dulwich.",
      "vulnerability": {
        "name": "CVE-2026-42305"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability CVE-2026-47734 affects version 0.21.7.post2+tuxcare of dulwich.",
      "vulnerability": {
        "name": "CVE-2026-47734"
      },
      "action_statement": "Vulnerability CVE-2026-47734 affects version 0.21.7.post2+tuxcare of dulwich."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.21.7.post2+tuxcare of dulwich.",
      "vulnerability": {
        "name": "GHSA-35mr-4567-66vg"
      },
      "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.21.7.post2+tuxcare of dulwich."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 does not affect version 0.21.7.post2+tuxcare of dulwich. GHSA-5fqc-mrg8-w798 (filter-branch): dulwich/filter_branch.py does not exist in 0.21.7 (added upstream in 0.23.1). Reviewed in PYELSCVE-2844.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-5fqc-mrg8-w798"
      },
      "impact_statement": "GHSA-5fqc-mrg8-w798 (filter-branch): dulwich/filter_branch.py does not exist in 0.21.7 (added upstream in 0.23.1). Reviewed in PYELSCVE-2844."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf is fixed in version 0.21.7.post2+tuxcare of dulwich.",
      "vulnerability": {
        "name": "GHSA-8mcx-5rqc-vhmf"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 does not affect version 0.21.7.post2+tuxcare of dulwich. GHSA-8w8g-wq8h-fq33 (checkout(paths=) via os.open): dulwich 0.21.7 porcelain has no checkout() function, no os.open() call and no _checked_worktree_path (checkout() appeared in 0.23.x, the os.open path in 0.24.0). Reviewed in PYELSCVE-2844.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8w8g-wq8h-fq33"
      },
      "impact_statement": "GHSA-8w8g-wq8h-fq33 (checkout(paths=) via os.open): dulwich 0.21.7 porcelain has no checkout() function, no os.open() call and no _checked_worktree_path (checkout() appeared in 0.23.x, the os.open path in 0.24.0). Reviewed in PYELSCVE-2844."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-26T11:34:52.577982+00:00",
      "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx does not affect version 0.21.7.post2+tuxcare of dulwich. GHSA-cm62-gvxx-vmxx (stash pop path traversal): in dulwich 0.21.7 Stash.pop() is `raise NotImplementedError(self.pop)` (dulwich/stash.py:70); pop was first implemented upstream in 0.24.0, so the vulnerable code is absent. Reviewed in PYELSCVE-2844.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-cm62-gvxx-vmxx"
      },
      "impact_statement": "GHSA-cm62-gvxx-vmxx (stash pop path traversal): in dulwich 0.21.7 Stash.pop() is `raise NotImplementedError(self.pop)` (dulwich/stash.py:70); pop was first implemented upstream in 0.24.0, so the vulnerable code is absent. Reviewed in PYELSCVE-2844."
    }
  ]
}