{
  "@id": "urn:uuid:5aade9e9-7aef-4319-bdbb-2ae8bbd3a4ad",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:05:17.011429+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T04:40:00.129258+00:00",
      "status_notes": "Vulnerability CVE-2021-27568 does not affect version 2.5.0-tuxcare.1 of net.minidev:json-smart. not_affected \u2014 CVE-2021-27568 is NOT present in json-smart 2.5.0-tuxcare.1. The vulnerability concerns uncaught NumberFormatException during JSON number parsing that can cause application crashes or information disclosure. The upstream version 2.5.0 already includes the fix (commit c8133d2, Feb 26, 2021) that wraps Float.parseFloat(), Double.parseDouble(), and BigDecimal constructor calls in try-catch blocks ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-27568"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-27568 is NOT present in json-smart 2.5.0-tuxcare.1. The vulnerability concerns uncaught NumberFormatException during JSON number parsing that can cause application crashes or information disclosure. The upstream version 2.5.0 already includes the fix (commit c8133d2, Feb 26, 2021) that wraps Float.parseFloat(), Double.parseDouble(), and BigDecimal constructor calls in try-catch blocks ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:05:17.011429+00:00",
      "status_notes": "Vulnerability CVE-2021-31684 does not affect version 2.5.0-tuxcare.1 of net.minidev:json-smart. The target repository (json-smart version 2.5.0) is NOT AFFECTED by CVE-2021-31684. The vulnerability was an infinite loop in the indexOf function of JSONParserByteArray caused by an incorrect loop condition (checking 'pos < len' instead of 'i < len'). This bug was fixed in upstream commit 6ecff1c by HAPPY (pcy190@126.com) on April 16, 2021, and this fix was already included in the upstream 2.5.0 release before TuxCare onboarded it. The current code at line 81 of JSONParserByteArray.java correctly uses 'for (int i = pos; i < len; i++)' with the proper loop variable in the termination condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.3; >= 2.4.0, < 2.4.4), NVD (>= 1.3, < 1.3.3; >= 2.4, < 2.4.4), Snyk (>= 0, < 1.3.3; >= 2.0.0, < 2.4.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-31684"
      },
      "impact_statement": "The target repository (json-smart version 2.5.0) is NOT AFFECTED by CVE-2021-31684. The vulnerability was an infinite loop in the indexOf function of JSONParserByteArray caused by an incorrect loop condition (checking 'pos < len' instead of 'i < len'). This bug was fixed in upstream commit 6ecff1c by HAPPY (pcy190@126.com) on April 16, 2021, and this fix was already included in the upstream 2.5.0 release before TuxCare onboarded it. The current code at line 81 of JSONParserByteArray.java correctly uses 'for (int i = pos; i < len; i++)' with the proper loop variable in the termination condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.3; >= 2.4.0, < 2.4.4), NVD (>= 1.3, < 1.3.3; >= 2.4, < 2.4.4), Snyk (>= 0, < 1.3.3; >= 2.0.0, < 2.4.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:19.723998+00:00",
      "status_notes": "Vulnerability CVE-2023-1370 does not affect version 2.5.0-tuxcare.1 of net.minidev:json-smart. The target version 2.5.0-tuxcare.1 is NOT vulnerable to CVE-2023-1370. The fix for stack overflow via deeply nested JSON was already present in the upstream 2.5.0 release when TuxCare onboarded it. The defense (MAX_DEPTH=400 with depth tracking in readArray/readObject) is implemented and enabled by default via the LIMIT_JSON_DEPTH flag in MODE_PERMISSIVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.9), NVD (< 2.4.9), cve.org (< 2.4.9), Snyk (< 2.4.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-1370"
      },
      "impact_statement": "The target version 2.5.0-tuxcare.1 is NOT vulnerable to CVE-2023-1370. The fix for stack overflow via deeply nested JSON was already present in the upstream 2.5.0 release when TuxCare onboarded it. The defense (MAX_DEPTH=400 with depth tracking in readArray/readObject) is implemented and enabled by default via the LIMIT_JSON_DEPTH flag in MODE_PERMISSIVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.9), NVD (< 2.4.9), cve.org (< 2.4.9), Snyk (< 2.4.9)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-57699 is fixed in version 2.5.0-tuxcare.1 of net.minidev:json-smart.",
      "vulnerability": {
        "name": "CVE-2024-57699"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/net.minidev/json-smart@2.5.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T15:50:19.528729+00:00",
      "status_notes": "Vulnerability CVE-2026-113602 affects version 2.5.0-tuxcare.1 of net.minidev:json-smart.",
      "vulnerability": {
        "name": "CVE-2026-113602"
      },
      "action_statement": "Vulnerability CVE-2026-113602 affects version 2.5.0-tuxcare.1 of net.minidev:json-smart."
    }
  ]
}