{
  "@id": "urn:uuid:c76a0d92-a337-485d-b1a0-e2e29c43b725",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T05:08:00.118540+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.guava/guava-testlib@31.0.1-android-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.guava/guava-testlib@31.0.1-android-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T05:08:00.118540+00:00",
      "status_notes": "Vulnerability CVE-2018-10237 does not affect version 31.0.1-android-tuxcare.1 of com.google.guava:guava-testlib. not_affected \u2014 CVE-2018-10237 does not affect Guava 31.0.1-android. The vulnerability involved unbounded memory allocation during deserialization in AtomicDoubleArray (Java serialization) and CompoundOrdering (GWT serialization). The upstream fix was applied by Google in April 2018 (commit f89ece5721) and was already present in the upstream release 31.0.1-android when TuxCare onboarded it. Additionally, GWT-R...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-10237"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-10237 does not affect Guava 31.0.1-android. The vulnerability involved unbounded memory allocation during deserialization in AtomicDoubleArray (Java serialization) and CompoundOrdering (GWT serialization). The upstream fix was applied by Google in April 2018 (commit f89ece5721) and was already present in the upstream release 31.0.1-android when TuxCare onboarded it. Additionally, GWT-R..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.guava/guava-testlib@31.0.1-android-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.guava/guava-testlib@31.0.1-android-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T08:10:28.465421+00:00",
      "status_notes": "Vulnerability CVE-2020-8908 affects version 31.0.1-android-tuxcare.1 of com.google.guava:guava-testlib.",
      "vulnerability": {
        "name": "CVE-2020-8908"
      },
      "action_statement": "Vulnerability CVE-2020-8908 affects version 31.0.1-android-tuxcare.1 of com.google.guava:guava-testlib."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.google.guava/guava-testlib@31.0.1-android-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.guava/guava-testlib@31.0.1-android-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T08:11:00.087796+00:00",
      "status_notes": "Vulnerability CVE-2023-2976 is fixed in version 31.0.1-android-tuxcare.1 of com.google.guava:guava-testlib.",
      "vulnerability": {
        "name": "CVE-2023-2976"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.google.guava/guava-testlib@31.0.1-android-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.google.guava/guava-testlib@31.0.1-android-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T14:33:21.618283+00:00",
      "status_notes": "Vulnerability CVE-2026-102554 affects version 31.0.1-android-tuxcare.1 of com.google.guava:guava-testlib.",
      "vulnerability": {
        "name": "CVE-2026-102554"
      },
      "action_statement": "Vulnerability CVE-2026-102554 affects version 31.0.1-android-tuxcare.1 of com.google.guava:guava-testlib."
    }
  ]
}