{ "@id": "urn:uuid:14c86b94-df60-4622-8760-216f93bfd948", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-03T10:12:46.442569+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p3+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p3+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p3+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p3+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p3+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-13080" }, "action_statement": "Vulnerability CVE-2025-13080 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-6366" }, "action_statement": "Vulnerability CVE-2026-6366 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p3+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." } ] }