{
  "@id": "urn:uuid:aa5caacf-9987-4b75-9852-80390480f7b7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:16.618549+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.code.gson/gson@2.8.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.code.gson/gson@2.8.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:27:44.373678+00:00",
      "status_notes": "Vulnerability CVE-2022-25647 does not affect version 2.8.9-tuxcare.1 of com.google.code.gson:gson. The target repository (Gson 2.8.9-tuxcare.1) is NOT affected by CVE-2022-25647. The vulnerability was fixed in upstream Gson 2.8.9 (released by Google), and TuxCare onboarded this already-fixed version. The fix prevents direct Java deserialization of internal classes (LazilyParsedNumber, LinkedTreeMap, LinkedHashTreeMap) by adding readObject() methods that throw InvalidObjectException, forcing deserialization to use only the intended writeReplace() replacement path. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.8.9), NVD (>= 2.2.3, < 2.8.9), cve.org (< 2.8.9), Snyk (>= 2.2.3, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-25647"
      },
      "impact_statement": "The target repository (Gson 2.8.9-tuxcare.1) is NOT affected by CVE-2022-25647. The vulnerability was fixed in upstream Gson 2.8.9 (released by Google), and TuxCare onboarded this already-fixed version. The fix prevents direct Java deserialization of internal classes (LazilyParsedNumber, LinkedTreeMap, LinkedHashTreeMap) by adding readObject() methods that throw InvalidObjectException, forcing deserialization to use only the intended writeReplace() replacement path. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.8.9), NVD (>= 2.2.3, < 2.8.9), cve.org (< 2.8.9), Snyk (>= 2.2.3, < 2.8.9)."
    }
  ]
}