{
  "@id": "urn:uuid:6a88085e-0e4a-4aad-a1da-d04920a80a0e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:04:03.421384+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T04:37:00.068452+00:00",
      "status_notes": "Vulnerability CVE-2021-27568 does not affect version 2.4.8-tuxcare.1 of net.minidev:json-smart. not_affected \u2014 CVE-2021-27568 is NOT present in json-smart v2.4.8. The vulnerability involved uncaught NumberFormatException during JSON number parsing that could cause application crashes or information disclosure. The upstream vendor (netplex) fixed this issue in commit c98873a3 by adding try-catch blocks around all Double.parseDouble(), Float.parseFloat(), and BigDecimal constructor calls in the JSONParser...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-27568"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-27568 is NOT present in json-smart v2.4.8. The vulnerability involved uncaught NumberFormatException during JSON number parsing that could cause application crashes or information disclosure. The upstream vendor (netplex) fixed this issue in commit c98873a3 by adding try-catch blocks around all Double.parseDouble(), Float.parseFloat(), and BigDecimal constructor calls in the JSONParser..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:04:03.421384+00:00",
      "status_notes": "Vulnerability CVE-2021-31684 does not affect version 2.4.8-tuxcare.1 of net.minidev:json-smart. CVE-2021-31684 is not present in json-smart 2.4.8. The vulnerability was an infinite loop bug in the indexOf method of JSONParserByteArray where the loop condition incorrectly checked 'pos < len' instead of 'i < len'. This was fixed by upstream commit 6ecff1c2974eaaab2e74e441bdf5ba8495227bf5 (authored by HAPPY <pcy190@126.com> on Apr 16, 2021) which changed the condition to correctly check the incrementing loop variable. The fix was included in upstream version 2.4.5 and was already present when TuxCare onboarded version 2.4.8 on commit 9277716 by amoniatovskiy@cloudlinux.com. The current HEAD (40b3ace) contains the corrected code at line 81: 'for (int i = pos; i < len; i++)'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.3; >= 2.4.0, < 2.4.4), NVD (>= 1.3, < 1.3.3; >= 2.4, < 2.4.4), Snyk (>= 0, < 1.3.3; >= 2.0.0, < 2.4.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-31684"
      },
      "impact_statement": "CVE-2021-31684 is not present in json-smart 2.4.8. The vulnerability was an infinite loop bug in the indexOf method of JSONParserByteArray where the loop condition incorrectly checked 'pos < len' instead of 'i < len'. This was fixed by upstream commit 6ecff1c2974eaaab2e74e441bdf5ba8495227bf5 (authored by HAPPY <pcy190@126.com> on Apr 16, 2021) which changed the condition to correctly check the incrementing loop variable. The fix was included in upstream version 2.4.5 and was already present when TuxCare onboarded version 2.4.8 on commit 9277716 by amoniatovskiy@cloudlinux.com. The current HEAD (40b3ace) contains the corrected code at line 81: 'for (int i = pos; i < len; i++)'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.3; >= 2.4.0, < 2.4.4), NVD (>= 1.3, < 1.3.3; >= 2.4, < 2.4.4), Snyk (>= 0, < 1.3.3; >= 2.0.0, < 2.4.5)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-1370 affects version 2.4.8-tuxcare.1 of net.minidev:json-smart.",
      "vulnerability": {
        "name": "CVE-2023-1370"
      },
      "action_statement": "Vulnerability CVE-2023-1370 affects version 2.4.8-tuxcare.1 of net.minidev:json-smart."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T04:08:51.772780+00:00",
      "status_notes": "Vulnerability CVE-2024-57699 affects version 2.4.8-tuxcare.1 of net.minidev:json-smart.",
      "vulnerability": {
        "name": "CVE-2024-57699"
      },
      "action_statement": "Vulnerability CVE-2024-57699 affects version 2.4.8-tuxcare.1 of net.minidev:json-smart."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:50:19.528729+00:00",
      "status_notes": "Vulnerability CVE-2026-113602 affects version 2.4.8-tuxcare.1 of net.minidev:json-smart.",
      "vulnerability": {
        "name": "CVE-2026-113602"
      },
      "action_statement": "Vulnerability CVE-2026-113602 affects version 2.4.8-tuxcare.1 of net.minidev:json-smart."
    }
  ]
}