{
  "@id": "urn:uuid:fa2e5c73-3a30-4123-8bcc-e126988aedff",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T21:21:00.077862+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.json/json@20140107-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.json/json@20140107-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45688 is fixed in version 20140107-tuxcare.1 of org.json:json.",
      "vulnerability": {
        "name": "CVE-2022-45688"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.json/json@20140107-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.json/json@20140107-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-5072 affects version 20140107-tuxcare.1 of org.json:json, and is fixed in 20140107-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-5072"
      },
      "action_statement": "Vulnerability CVE-2023-5072 affects version 20140107-tuxcare.1 of org.json:json, and is fixed in 20140107-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.json/json@20140107-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.json/json@20140107-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T21:21:00.077862+00:00",
      "status_notes": "Vulnerability CVE-2026-59171 does not affect version 20140107-tuxcare.1 of org.json:json. not_affected \u2014 Target is org.json 20140107 (TuxCare branch). It predates BigInteger/BigDecimal support (added in 20150729). The only numeric conversion is new Long(string), which throws on overflow, and Double.valueOf(string), which parses long digit strings in linear time. Oversized numeric tokens are accumulated in linear time, with no super-linear (O(n^1.585)) construction. The CVE's amplification step is ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59171"
      },
      "impact_statement": "not_affected \u2014 Target is org.json 20140107 (TuxCare branch). It predates BigInteger/BigDecimal support (added in 20150729). The only numeric conversion is new Long(string), which throws on overflow, and Double.valueOf(string), which parses long digit strings in linear time. Oversized numeric tokens are accumulated in linear time, with no super-linear (O(n^1.585)) construction. The CVE's amplification step is ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.json/json@20140107-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.json/json@20140107-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-rm7j-f5g5-27vv is a false positive for org.json:json 20140107-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-rm7j-f5g5-27vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}