{ "@id": "urn:uuid:bcab55dd-66c1-4576-bcda-58ba8c8f0482", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:10:25.284357+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-11-02T22:12:13.760329+00:00", "status_notes": "Vulnerability CVE-2018-11771 does not affect version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.26.2 is NOT AFFECTED. CVE-2018-11771 was fixed in Apache Commons Compress 1.18 (August 2018) and affects versions 1.7-1.17. The target version 1.26.2 was onboarded from upstream Apache with the fix already present. The vulnerability pattern (ZipArchiveInputStream.readStored silently returning -1 on truncated entries, enabling infinite stream reading) has been replaced with expl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11771" }, "impact_statement": "not_affected \u2014 Target version 1.26.2 is NOT AFFECTED. CVE-2018-11771 was fixed in Apache Commons Compress 1.18 (August 2018) and affects versions 1.7-1.17. The target version 1.26.2 was onboarded from upstream Apache with the fix already present. The vulnerability pattern (ZipArchiveInputStream.readStored silently returning -1 on truncated entries, enabling infinite stream reading) has been replaced with expl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-11-03T11:33:36.366714+00:00", "status_notes": "Vulnerability CVE-2018-1324 does not affect version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress 1.26.2 is NOT affected by CVE-2018-1324. The vulnerability (infinite loop in ZIP extra field parser due to integer overflow) was fixed in the upstream Apache release before TuxCare onboarded this version. The vulnerable loop pattern is completely absent from the current codebase - the loop was first fixed by changing the counter type from int to long (commit 2a2f1dc48, D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1324" }, "impact_statement": "not_affected \u2014 Apache Commons Compress 1.26.2 is NOT affected by CVE-2018-1324. The vulnerability (infinite loop in ZIP extra field parser due to integer overflow) was fixed in the upstream Apache release before TuxCare onboarded this version. The vulnerable loop pattern is completely absent from the current codebase - the loop was first fixed by changing the counter type from int to long (commit 2a2f1dc48, D..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-12402 does not affect version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress. CVE-2019-12402 affects Apache Commons Compress 1.15-1.18 (infinite loop in NioZipEncoding#encode). Target version 1.26.2 contains the upstream fix from commit 4ad5d80a (Stefan Bodewig, 2019-08-23), which shipped in version 1.19 (2019-08-27). The fix was already in the upstream release when TuxCare onboarded 1.26.2. The vulnerable pattern (missing break for underflow/error states in encoding loop) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12402" }, "impact_statement": "CVE-2019-12402 affects Apache Commons Compress 1.15-1.18 (infinite loop in NioZipEncoding#encode). Target version 1.26.2 contains the upstream fix from commit 4ad5d80a (Stefan Bodewig, 2019-08-23), which shipped in version 1.19 (2019-08-27). The fix was already in the upstream release when TuxCare onboarded 1.26.2. The vulnerable pattern (missing break for underflow/error states in encoding loop) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2021-35515 affects version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2021-35515" }, "action_statement": "Vulnerability CVE-2021-35515 affects version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2021-35516 affects version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2021-35516" }, "action_statement": "Vulnerability CVE-2021-35516 affects version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2021-35517 affects version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2021-35517" }, "action_statement": "Vulnerability CVE-2021-35517 affects version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2021-36090 does not affect version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress. Apache Commons Compress 1.26.2 is not affected by CVE-2021-36090. The vulnerability was fixed in upstream version 1.21 (July 2021) with commits ef5d70b and 80124dd, which added validation of size/length values before memory allocation and introduced the IOUtils.readRange() read-then-allocate pattern. Version 1.26.2, released in 2024, already contains these fixes from the upstream Apache release. The fix was not backported by TuxCare\u2014it was already present when version 1.26.2 was onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-36090" }, "impact_statement": "Apache Commons Compress 1.26.2 is not affected by CVE-2021-36090. The vulnerability was fixed in upstream version 1.21 (July 2021) with commits ef5d70b and 80124dd, which added validation of size/length values before memory allocation and introduced the IOUtils.readRange() read-then-allocate pattern. Version 1.26.2, released in 2024, already contains these fixes from the upstream Apache release. The fix was not backported by TuxCare\u2014it was already present when version 1.26.2 was onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-11-03T12:24:19.585233+00:00", "status_notes": "Vulnerability CVE-2023-42503 does not affect version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.26.2-tuxcare.1 is NOT AFFECTED. The vulnerability pattern has been removed by an upstream fix that was already present in Apache Commons Compress version 1.26.2 when TuxCare onboarded it. The fix adds input validation to PAX extended header time fields (mtime, atime, ctime, LIBARCHIVE.creationtime) before BigDecimal parsing, preventing DoS attacks via numbers with excessive dig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42503" }, "impact_statement": "not_affected \u2014 Target version 1.26.2-tuxcare.1 is NOT AFFECTED. The vulnerability pattern has been removed by an upstream fix that was already present in Apache Commons Compress version 1.26.2 when TuxCare onboarded it. The fix adds input validation to PAX extended header time fields (mtime, atime, ctime, LIBARCHIVE.creationtime) before BigDecimal parsing, preventing DoS attacks via numbers with excessive dig..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2024-25710 does not affect version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress. CVE-2024-25710 affects Apache Commons Compress versions 1.3 through 1.25.0, causing an infinite loop vulnerability in dump archive parsing when blockSize becomes zero or negative. The target version is 1.26.2-tuxcare.1, which contains the upstream fix from Apache Commons Compress 1.26.0. The fix was introduced by upstream commit 8a9a5847c04ae39a1d45b365f8bb82022466067d (authored by yakovsh@amazon.com) and was already present when TuxCare onboarded version 1.26.2. The vulnerable pattern has been removed by validation checks that reject malformed dump archives before they can trigger infinite loops.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3, < 1.26.0), NVD (>= 1.3, < 1.26.0), cve.org (>= 1.3, <= 1.25.0), Snyk (>= 1.3, < 1.26.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-25710" }, "impact_statement": "CVE-2024-25710 affects Apache Commons Compress versions 1.3 through 1.25.0, causing an infinite loop vulnerability in dump archive parsing when blockSize becomes zero or negative. The target version is 1.26.2-tuxcare.1, which contains the upstream fix from Apache Commons Compress 1.26.0. The fix was introduced by upstream commit 8a9a5847c04ae39a1d45b365f8bb82022466067d (authored by yakovsh@amazon.com) and was already present when TuxCare onboarded version 1.26.2. The vulnerable pattern has been removed by validation checks that reject malformed dump archives before they can trigger infinite loops.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3, < 1.26.0), NVD (>= 1.3, < 1.26.0), cve.org (>= 1.3, <= 1.25.0), Snyk (>= 1.3, < 1.26.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.2-tuxcare.1" } } ], "timestamp": "2026-11-03T12:27:39.447287+00:00", "status_notes": "Vulnerability CVE-2024-26308 does not affect version 1.26.2-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2024-26308 affects Apache Commons Compress versions 1.21 through 1.25. The target is version 1.26.2, which includes the upstream vendor fix (commit a770a37bf) that adds a null-check for ClassLoader in Pack200.newInstance. This fix, along with related COMPRESS-626/628 EOF validation fixes, shipped in upstream release 1.26.0 and was inherited when TuxCare onboarded version 1.26.2. The vulnera...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-26308" }, "impact_statement": "not_affected \u2014 CVE-2024-26308 affects Apache Commons Compress versions 1.21 through 1.25. The target is version 1.26.2, which includes the upstream vendor fix (commit a770a37bf) that adds a null-check for ClassLoader in Pack200.newInstance. This fix, along with related COMPRESS-626/628 EOF validation fixes, shipped in upstream release 1.26.0 and was inherited when TuxCare onboarded version 1.26.2. The vulnera..." } ] }