{
  "@id": "urn:uuid:4f2f12de-4acc-41a7-af2a-831267efcdd3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 22,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T13:48:55.990847+00:00",
      "status_notes": "Vulnerability CVE-2013-7285 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. XStream 1.4.17 is not vulnerable to CVE-2013-7285. No backport is needed. The vulnerability affects XStream up to 1.4.6 and 1.4.10 and was fixed upstream in 1.4.7 (commit 94666ae6). The 1.4.17 baseline (tag XSTREAM_1_4_17) already rejects java.beans.EventHandler and java.lang.ProcessBuilder by default: the XStream constructor calls setupSecurity(), which denies both types, and SecurityMapper.realClass() throws ForbiddenClassException for them. The previous attribution to TuxCare commit e9e0b87 was a false positive (email-domain match): that commit is the CVE-2021-39146 backport, which replaced the default blocklist with an allowlist that still excludes both types.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-7285"
      },
      "impact_statement": "XStream 1.4.17 is not vulnerable to CVE-2013-7285. No backport is needed. The vulnerability affects XStream up to 1.4.6 and 1.4.10 and was fixed upstream in 1.4.7 (commit 94666ae6). The 1.4.17 baseline (tag XSTREAM_1_4_17) already rejects java.beans.EventHandler and java.lang.ProcessBuilder by default: the XStream constructor calls setupSecurity(), which denies both types, and SecurityMapper.realClass() throws ForbiddenClassException for them. The previous attribution to TuxCare commit e9e0b87 was a false positive (email-domain match): that commit is the CVE-2021-39146 backport, which replaced the default blocklist with an allowlist that still excludes both types."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:00:45.012229+00:00",
      "status_notes": "Vulnerability CVE-2016-3674 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. CVE-2016-3674 XXE vulnerability is NOT present in target XStream 1.4.17. All 7 affected XML drivers (DomDriver, Dom4JDriver, JDomDriver, JDom2Driver, SjsxpDriver, StandardStaxDriver, WstxDriver) have XXE protections enabled by default. The fixes were applied in upstream XStream 1.4.9 and shipped with the upstream 1.4.17 release that TuxCare onboarded. Fix commit d2bfd5a8 by upstream maintainer joerg.schaible@gmx.de predates TuxCare involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.4.9), NVD (< 1.4.9), Snyk (>= 0.3, < 1.4.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-3674"
      },
      "impact_statement": "CVE-2016-3674 XXE vulnerability is NOT present in target XStream 1.4.17. All 7 affected XML drivers (DomDriver, Dom4JDriver, JDomDriver, JDom2Driver, SjsxpDriver, StandardStaxDriver, WstxDriver) have XXE protections enabled by default. The fixes were applied in upstream XStream 1.4.9 and shipped with the upstream 1.4.17 release that TuxCare onboarded. Fix commit d2bfd5a8 by upstream maintainer joerg.schaible@gmx.de predates TuxCare involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.4.9), NVD (< 1.4.9), Snyk (>= 0.3, < 1.4.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:19.723998+00:00",
      "status_notes": "Vulnerability CVE-2017-7957 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. CVE-2017-7957 (void deserialization crash) is NOT present in XStream 1.4.17-tuxcare.2. The upstream fix (commit 6e546ec3) by joerg.schaible@gmx.de was already included in the upstream 1.4.17 release when TuxCare onboarded it. Both protection mechanisms are present: (1) SunLimitedUnsafeReflectionProvider.java explicitly rejects void.class/Void.class before allocation (lines 81-82), and (2) PrimitiveTypePermission.java excludes void/Void from allowed primitive types (lines 25-26). The vulnerable pattern (unguarded void instantiation leading to crash) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.4.10), NVD (<= 1.4.9), Snyk (< 1.4.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7957"
      },
      "impact_statement": "CVE-2017-7957 (void deserialization crash) is NOT present in XStream 1.4.17-tuxcare.2. The upstream fix (commit 6e546ec3) by joerg.schaible@gmx.de was already included in the upstream 1.4.17 release when TuxCare onboarded it. Both protection mechanisms are present: (1) SunLimitedUnsafeReflectionProvider.java explicitly rejects void.class/Void.class before allocation (lines 81-82), and (2) PrimitiveTypePermission.java excludes void/Void from allowed primitive types (lines 25-26). The vulnerable pattern (unguarded void instantiation leading to crash) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.4.10), NVD (<= 1.4.9), Snyk (< 1.4.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2019-10173 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. CVE-2019-10173 affects XStream 1.4.10 (a regression of CVE-2013-7285). The target is version 1.4.17-tuxcare.2, which already contains the upstream fix from version 1.4.11+. The vulnerable pattern (AnyTypePermission.ANY in setupSecurity without proper blacklist enforcement via broken InternalBlackList) is not present. The fix was authored by upstream XStream maintainer (joerg.schaible@gmx.de) and shipped in the upstream release 1.4.17 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.10, < 1.4.11), NVD (= 1.4.10), cve.org (< 1.4.11), Snyk (>= 1.4.10, < 1.4.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10173"
      },
      "impact_statement": "CVE-2019-10173 affects XStream 1.4.10 (a regression of CVE-2013-7285). The target is version 1.4.17-tuxcare.2, which already contains the upstream fix from version 1.4.11+. The vulnerable pattern (AnyTypePermission.ANY in setupSecurity without proper blacklist enforcement via broken InternalBlackList) is not present. The fix was authored by upstream XStream maintainer (joerg.schaible@gmx.de) and shipped in the upstream release 1.4.17 that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.4.10, < 1.4.11), NVD (= 1.4.10), cve.org (< 1.4.11), Snyk (>= 1.4.10, < 1.4.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:58.922832+00:00",
      "status_notes": "Vulnerability CVE-2020-26217 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. CVE-2020-26217 affects XStream versions prior to 1.4.14 by allowing remote code execution through deserialization of javax.imageio.ImageIO$ContainsFilter. The target repository is XStream 1.4.17-tuxcare.2, based on upstream XStream 1.4.17. The fix for this CVE (adding ImageIO$ContainsFilter to the default blacklist) was already present in the upstream 1.4.17 release via commit 0fec095d by upstream maintainer joehni (joerg.schaible@gmx.de), dated 2020-09-24. This commit is an ancestor of the TuxCare onboarding commit b223bc39, confirming the fix shipped in the upstream release. Therefore, the target is not affected\u2014the vulnerable pattern was never present in this version. The current HEAD additionally switched to a whitelist-based security model (via CVE-2021-39146 backport), providing even stronger protection by only allowing explicitly whitelisted types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.4.14-java7), NVD (< 1.4.14), cve.org (< 1.4.14), Snyk (< 1.4.14).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26217"
      },
      "impact_statement": "CVE-2020-26217 affects XStream versions prior to 1.4.14 by allowing remote code execution through deserialization of javax.imageio.ImageIO$ContainsFilter. The target repository is XStream 1.4.17-tuxcare.2, based on upstream XStream 1.4.17. The fix for this CVE (adding ImageIO$ContainsFilter to the default blacklist) was already present in the upstream 1.4.17 release via commit 0fec095d by upstream maintainer joehni (joerg.schaible@gmx.de), dated 2020-09-24. This commit is an ancestor of the TuxCare onboarding commit b223bc39, confirming the fix shipped in the upstream release. Therefore, the target is not affected\u2014the vulnerable pattern was never present in this version. The current HEAD additionally switched to a whitelist-based security model (via CVE-2021-39146 backport), providing even stronger protection by only allowing explicitly whitelisted types.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.4.14-java7), NVD (< 1.4.14), cve.org (< 1.4.14), Snyk (< 1.4.14)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-26258 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. already_fixed \u2014 CVE-2020-26258 has already been fixed in the target repository. The vendor patch commit 6740c04b217aef02d44fba26402b35e0f6f493ce is present, adding 'jdk.nashorn.internal.objects.NativeString' to the default blacklist in XStream's security framework. This prevents the Server-Side Request Forgery attack chain described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26258"
      },
      "impact_statement": "already_fixed \u2014 CVE-2020-26258 has already been fixed in the target repository. The vendor patch commit 6740c04b217aef02d44fba26402b35e0f6f493ce is present, adding 'jdk.nashorn.internal.objects.NativeString' to the default blacklist in XStream's security framework. This prevents the Server-Side Request Forgery attack chain described in the CVE."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-26259 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. already_fixed \u2014 XStream version 1.4.17 already contains a fix for CVE-2020-26259. The target has an even stronger defense than the original 1.4.15 fix: it denies the entire InputStream type hierarchy, which comprehensively blocks ReadAllStream$FileStream and all other malicious InputStream subclasses.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-26259"
      },
      "impact_statement": "already_fixed \u2014 XStream version 1.4.17 already contains a fix for CVE-2020-26259. The target has an even stronger defense than the original 1.4.15 fix: it denies the entire InputStream type hierarchy, which comprehensively blocks ReadAllStream$FileStream and all other malicious InputStream subclasses."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2021-21341 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. XStream 1.4.17 already contains the upstream fix for CVE-2021-21341. The vulnerability allowed attackers to cause denial of service by deserializing manipulated ByteArrayInputStream objects with malformed fields (e.g., negative position value) that trigger endless loops. The fix blocks all InputStream subclasses from deserialization. The current version uses a whitelist security model where InputStream is not in the allowed types list, preventing the attack. The original fix (commit d5e51177) was authored by upstream XStream maintainer J\u00f6rg Schaible and shipped in the 1.4.17 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.4.16), NVD (< 1.4.16), cve.org (< 1.4.16), Snyk (< 1.4.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21341"
      },
      "impact_statement": "XStream 1.4.17 already contains the upstream fix for CVE-2021-21341. The vulnerability allowed attackers to cause denial of service by deserializing manipulated ByteArrayInputStream objects with malformed fields (e.g., negative position value) that trigger endless loops. The fix blocks all InputStream subclasses from deserialization. The current version uses a whitelist security model where InputStream is not in the allowed types list, preventing the attack. The original fix (commit d5e51177) was authored by upstream XStream maintainer J\u00f6rg Schaible and shipped in the 1.4.17 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.4.16), NVD (< 1.4.16), cve.org (< 1.4.16), Snyk (< 1.4.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T03:23:32.263881+00:00",
      "status_notes": "Vulnerability CVE-2021-21342 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. not_affected \u2014 CVE-2021-21342 describes a Server-Side Forgery Request vulnerability via javax.activation.DataSource instantiation during deserialization. The upstream XStream 1.4.16 release (March 2021) included the fix for this CVE by denying the DataSource type hierarchy in its blacklist-based security. When TuxCare onboarded upstream XStream 1.4.17 (released May 2021), this fix was already present. Subsequ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21342"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21342 describes a Server-Side Forgery Request vulnerability via javax.activation.DataSource instantiation during deserialization. The upstream XStream 1.4.16 release (March 2021) included the fix for this CVE by denying the DataSource type hierarchy in its blacklist-based security. When TuxCare onboarded upstream XStream 1.4.17 (released May 2021), this fix was already present. Subsequ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T03:50:40.921234+00:00",
      "status_notes": "Vulnerability CVE-2021-21343 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. not_affected \u2014 CVE-2021-21343 is not present in XStream 1.4.17-tuxcare.2. The vulnerability allows attackers to manipulate XML input to deserialize InputStream objects with corrupted internal state, potentially causing file deletion or other malicious behavior. The upstream fix (commit d5e51177 by joerg.schaible@gmx.de, dated March 9, 2021) added `denyTypeHierarchy(InputStream.class)` to block all InputStream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21343"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21343 is not present in XStream 1.4.17-tuxcare.2. The vulnerability allows attackers to manipulate XML input to deserialize InputStream objects with corrupted internal state, potentially causing file deletion or other malicious behavior. The upstream fix (commit d5e51177 by joerg.schaible@gmx.de, dated March 9, 2021) added `denyTypeHierarchy(InputStream.class)` to block all InputStream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T16:57:00.115125+00:00",
      "status_notes": "Vulnerability CVE-2021-21344 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. not_affected \u2014 CVE-2021-21344 allows remote code execution via XStream deserialization of InputStream objects with attacker-controlled internal state (e.g., ByteArrayInputStream with pos=-2147483648 causing endless reads). The vulnerability affects XStream versions before 1.4.16. The target is version 1.4.17-tuxcare.2, which inherited the upstream fix from version 1.4.17. The fix (commit d5e51177 by joerg.sch...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21344"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21344 allows remote code execution via XStream deserialization of InputStream objects with attacker-controlled internal state (e.g., ByteArrayInputStream with pos=-2147483648 causing endless reads). The vulnerability affects XStream versions before 1.4.16. The target is version 1.4.17-tuxcare.2, which inherited the upstream fix from version 1.4.17. The fix (commit d5e51177 by joerg.sch..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T19:20:00.213522+00:00",
      "status_notes": "Vulnerability CVE-2021-21345 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. not_affected \u2014 CVE-2021-21345 affects XStream versions using the default blacklist security model, allowing deserialization of ByteArrayInputStream with manipulated fields (pos=-2147483648) causing resource exhaustion through endless zero-byte reads. The target repository (xstream 1.4.17-tuxcare.2) is NOT affected because the upstream fix was already present in the 1.4.17 release that TuxCare onboarded. The o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21345"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21345 affects XStream versions using the default blacklist security model, allowing deserialization of ByteArrayInputStream with manipulated fields (pos=-2147483648) causing resource exhaustion through endless zero-byte reads. The target repository (xstream 1.4.17-tuxcare.2) is NOT affected because the upstream fix was already present in the 1.4.17 release that TuxCare onboarded. The o..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:48:07.176896+00:00",
      "status_notes": "Vulnerability CVE-2021-21346 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-21346"
      },
      "action_statement": "Vulnerability CVE-2021-21346 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T00:14:49.554068+00:00",
      "status_notes": "Vulnerability CVE-2021-21347 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. not_affected \u2014 Target XStream 1.4.17 is not affected by CVE-2021-21347. The vulnerability affects versions up to 1.4.15, and the fix was included in upstream version 1.4.16 (commit d5e51177 by Joerg Schaible). The TuxCare-onboarded 1.4.17 release inherited this fix. Additionally, TuxCare later backported CVE-2021-39146 which replaced the blacklist security model with a more secure whitelist approach that also...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21347"
      },
      "impact_statement": "not_affected \u2014 Target XStream 1.4.17 is not affected by CVE-2021-21347. The vulnerability affects versions up to 1.4.15, and the fix was included in upstream version 1.4.16 (commit d5e51177 by Joerg Schaible). The TuxCare-onboarded 1.4.17 release inherited this fix. Additionally, TuxCare later backported CVE-2021-39146 which replaced the blacklist security model with a more secure whitelist approach that also..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:45:22.088279+00:00",
      "status_notes": "Vulnerability CVE-2021-21348 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-21348"
      },
      "action_statement": "Vulnerability CVE-2021-21348 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T23:21:30.903888+00:00",
      "status_notes": "Vulnerability CVE-2021-21349 does not affect version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream. not_affected \u2014 CVE-2021-21349 (Server-Side Forgery Request via InputStream deserialization) is not present in XStream 1.4.17-tuxcare.2. The vulnerability affected versions up to 1.4.15 and was fixed in upstream version 1.4.16. The target was onboarded from upstream 1.4.17, which already contained the fix authored by joerg.schaible@gmx.de in commit d5e51177634afea7213b9dc2d21f101d2e258db9. The vulnerable patte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21349"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21349 (Server-Side Forgery Request via InputStream deserialization) is not present in XStream 1.4.17-tuxcare.2. The vulnerability affected versions up to 1.4.15 and was fixed in upstream version 1.4.16. The target was onboarded from upstream 1.4.17, which already contained the fix authored by joerg.schaible@gmx.de in commit d5e51177634afea7213b9dc2d21f101d2e258db9. The vulnerable patte..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2021-21350 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-21350"
      },
      "action_statement": "Vulnerability CVE-2021-21350 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:45:22.088279+00:00",
      "status_notes": "Vulnerability CVE-2021-21351 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-21351"
      },
      "action_statement": "Vulnerability CVE-2021-21351 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:38:45.879676+00:00",
      "status_notes": "Vulnerability CVE-2021-29505 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-29505"
      },
      "action_statement": "Vulnerability CVE-2021-29505 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39139 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39139"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39140 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39140"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39141 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39141"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39144 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39144"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39145 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39145"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39146 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39146"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39147 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39147"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39148 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39148"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39149 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39149"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39150 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39150"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39151 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39151"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39152 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39152"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39153 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39153"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-39154 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-39154"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-43859 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2021-43859"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-40151 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2022-40151"
      },
      "action_statement": "Vulnerability CVE-2022-40151 affects version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-41966 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2022-41966"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-47072 is fixed in version 1.4.17-tuxcare.2 of com.thoughtworks.xstream:xstream.",
      "vulnerability": {
        "name": "CVE-2024-47072"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.thoughtworks.xstream/xstream@1.4.17-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability GHSA-3mq5-fq9h-gj7j is a false positive for com.thoughtworks.xstream:xstream 1.4.17-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-3mq5-fq9h-gj7j"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}