{
  "schemaVersion": 1,
  "caseId": "guzzle-psr7-cve-2022-24775",
  "run": "historical-detection-20261020",
  "preregistration": {
    "artifactPath": "/evidence/benchmarks/historical-detection-20261020/preregistration.json",
    "sha256": "6c7ef71cffa3729de787444c67823b01afcda71d61b42f2a005fda892a07db91",
    "websiteCommit": "aeb254a5673d716048f72d500fc57aaca477042c"
  },
  "tool": {
    "name": "vettalon",
    "version": "0.3.0"
  },
  "models": {
    "finder": "claude-opus-5-5 via claude CLI 2.1.300 (Anthropic)",
    "verifiers": [
      "grok-4.7 via grok CLI 1.0.62 (xAI, container sandbox)",
      "gpt-oss-120b-medium via agy 1.4.3 (OpenAI family, host)"
    ]
  },
  "command": "vettalon scan <release tree> --profile deep --config roster.toml --finders claude --verifiers grok,agy --max-modules 8 --refuter-runs 1 --no-prior --time-budget 2400 --source-receipts --trace trace.jsonl --report report.json --fail-on none --lang en",
  "hintLevel": "L0",
  "target": {
    "file": "src/MessageTrait.php",
    "vulnerableRanges": [
      [
        166,
        211
      ]
    ],
    "fixedRanges": [
      [
        166,
        215
      ],
      [
        238,
        265
      ]
    ],
    "acceptedCwes": [
      "CWE-20",
      "CWE-93",
      "CWE-113",
      "CWE-74",
      "CWE-116",
      "CWE-644"
    ]
  },
  "arms": {
    "vulnerable": {
      "version": "2.1.0",
      "archiveUrl": "https://api.github.com/repos/guzzle/psr7/zipball/089edd38f5b8abba6cb01567c2a8aaa47cec4c72",
      "archiveSha256": "2b0b4998cf069344114189d7ad994960e86131b96c31c19716c86581ba7a49cc",
      "treeSha256": "54609a7bc46684319f16d6c2c8997da4ec90dcc611187111d211ff6a15ce0e6d",
      "excludedFiles": [
        "CHANGELOG.md"
      ],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "incomplete",
      "incompleteReason": "scope_not_fully_reviewed",
      "calls": {
        "total": 11,
        "finder": 8,
        "verifier": 3,
        "failed": 0
      },
      "reportSha256": "f9e27d8a28fbf48edebe0cfe1236d6b8fe00dd4234d685fa17a22da9b9625715",
      "modules": {
        "selected": 8,
        "reviewed": 8
      },
      "targetFile": {
        "reviewed": true,
        "truncated": false,
        "submittedSha256": "9aa38d41b8b37079449b20af462062b1754c3018628f5ae870849b22f9703550"
      },
      "outcome": "found",
      "matches": [
        {
          "file": "src/MessageTrait.php",
          "line": 208,
          "cwe": "CWE-113",
          "severity": "medium",
          "status": "needs_human",
          "title": "Header values are never checked for CR/LF, so attackers can inject headers or split requests",
          "verification": [
            {
              "model": "grok",
              "family": "xai",
              "verdict": "plausible"
            }
          ]
        }
      ],
      "otherFindings": {
        "total": 2,
        "byStatus": {
          "needs_human": 2
        },
        "reviewed": false
      }
    },
    "fixed": {
      "version": "2.1.1",
      "archiveUrl": "https://api.github.com/repos/guzzle/psr7/zipball/53491b6394cdcb66880063b82c0b16cf082711eb",
      "archiveSha256": "8779f4b13551df09105021dc2b259045aa0f467595fa9c9ff38b377125fb3513",
      "treeSha256": "47f79cb403ae2875c39dd0b6522ee929fd9894158e82649c5d9c6840621583f5",
      "excludedFiles": [
        "CHANGELOG.md"
      ],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "incomplete",
      "incompleteReason": "scope_not_fully_reviewed",
      "calls": {
        "total": 9,
        "finder": 8,
        "verifier": 1,
        "failed": 0
      },
      "reportSha256": "017533801d9d6ec8f1f67677ae3cd7fbe7e1526defeca65f44fa80212e5d5a06",
      "modules": {
        "selected": 8,
        "reviewed": 8
      },
      "targetFile": {
        "reviewed": true,
        "truncated": false,
        "submittedSha256": "a98506312e376bd4573d9a81bca65b82944ad141801b298fee1a2182ce6fd256"
      },
      "outcome": "notFlagged",
      "matches": [],
      "otherFindings": {
        "total": 1,
        "byStatus": {
          "needs_human": 1
        },
        "reviewed": false
      }
    }
  },
  "limitations": {
    "zh": "這是已公開、已修補漏洞的偵測基準，不是新發現。模型訓練資料可能已包含此公告或修補，命中不能證明模型是從程式碼推理出來的。候選與 needs_human 都不是自動確認，也沒有執行 PoC。比對標準在掃描前登錄；其他輸出只列數量，未經審閱、未公開位置。原始 report.json 與 trace 不公開，只列 SHA-256。單次執行，模型輸出有隨機性，重跑結果可能不同。",
    "en": "This is a detection benchmark on an already disclosed and patched issue, not a new discovery. The models may have seen the advisory or the fix during training, so a match does not show that the model reasoned it out from the code. Candidates and needs_human results are not automatic confirmation, and no PoC was run. Match criteria were registered before scanning. Other findings are listed as counts only; they were not reviewed and their locations are not published. The raw report.json and trace are not public; only their SHA-256 is listed. Single run; model output is nondeterministic and a rerun may differ."
  }
}