{
  "@id": "urn:uuid:92e22b6b-ba1f-4ad4-accb-285ed44c68c9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:08:00.067330+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T13:20:22.368161+00:00",
      "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "AIKIDO-2026-10659"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:22:24.364492+00:00",
      "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14775"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:45:11.789246+00:00",
      "status_notes": "Vulnerability CVE-2018-15133 does not affect version 9.52.21-p4+tuxcare of laravel/framework. The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15133"
      },
      "impact_statement": "The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:16:23.572849+00:00",
      "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p4+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2019-9081"
      },
      "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p4+tuxcare of laravel/framework."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:43.097163+00:00",
      "status_notes": "Vulnerability CVE-2020-19316 does not affect version 9.52.21-p4+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-19316"
      },
      "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:13.594930+00:00",
      "status_notes": "Vulnerability CVE-2020-24941 does not affect version 9.52.21-p4+tuxcare of laravel/framework. CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-24941"
      },
      "impact_statement": "CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:15.621975+00:00",
      "status_notes": "Vulnerability CVE-2021-21263 does not affect version 9.52.21-p4+tuxcare of laravel/framework. Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21263"
      },
      "impact_statement": "Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43808"
      },
      "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:44:10.208770+00:00",
      "status_notes": "Vulnerability CVE-2024-52301 does not affect version 9.52.21-p4+tuxcare of laravel/framework. The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-52301"
      },
      "impact_statement": "The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T13:20:22.368161+00:00",
      "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2025-27515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T13:20:22.368161+00:00",
      "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-102279"
      },
      "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-114508"
      },
      "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T13:20:48.512438+00:00",
      "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2026-114509"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-13T19:08:00.067330+00:00",
      "status_notes": "Vulnerability CVE-2026-128083 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The Illuminate Concurrency component (Concurrency::run(), the process driver that parses a child's stdout for a framework result message) does not exist in laravel/framework 9.52.21. The CVE affects 12.x and 13.x, where that component was introduced in 11.x. The vulnerable code is absent, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-128083"
      },
      "impact_statement": "not_affected \u2014 The Illuminate Concurrency component (Concurrency::run(), the process driver that parses a child's stdout for a framework result message) does not exist in laravel/framework 9.52.21. The CVE affects 12.x and 13.x, where that component was introduced in 11.x. The vulnerable code is absent, so the target is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p4+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-4mg9-vhxq-vm7j"
      },
      "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p4+tuxcare of laravel/framework."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T13:20:22.368161+00:00",
      "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 9.52.21-p4+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-5vg9-5847-vvmq"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:04:11.478044+00:00",
      "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6jvx-8ch9-j2jr"
      },
      "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7852-w36x-6mf6"
      },
      "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T13:20:22.368161+00:00",
      "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-crmm-hgp2-wgrp"
      },
      "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-jwvj-pwww-3mj5"
      },
      "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:19:00.105438+00:00",
      "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 9.52.21-p4+tuxcare of laravel/framework. The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-qm5c-m76r-2hfr"
      },
      "impact_statement": "The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wq8p-mqvg-2p5h"
      },
      "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:42:13.594930+00:00",
      "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 9.52.21-p4+tuxcare of laravel/framework. Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-x7p5-p2c9-phvg"
      },
      "impact_statement": "Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results."
    }
  ]
}