{ "@id": "urn:uuid:1dd346b2-2063-4486-97f0-b9a7e508c9eb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T17:09:44.826457+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2005-4838 is a false positive for org.apache.cxf:apache-cxf 3.5.11-tuxcare.13. false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository.", "vulnerability": { "name": "CVE-2005-4838" }, "impact_statement": "false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2006-7196 is a false positive for org.apache.cxf:apache-cxf 3.5.11-tuxcare.13. false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository.", "vulnerability": { "name": "CVE-2006-7196" }, "impact_statement": "false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2007-1358 is a false positive for org.apache.cxf:apache-cxf 3.5.11-tuxcare.13. false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match.", "vulnerability": { "name": "CVE-2007-1358" }, "impact_statement": "false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2007-2449 is a false positive for org.apache.cxf:apache-cxf 3.5.11-tuxcare.13. false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match.", "vulnerability": { "name": "CVE-2007-2449" }, "impact_statement": "false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2008-0128 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2008-0128" }, "impact_statement": "not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.", "vulnerability": { "name": "CVE-2009-2696" }, "impact_statement": "Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:apache-cxf 3.5.11-tuxcare.13. false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository.", "vulnerability": { "name": "CVE-2010-1151" }, "impact_statement": "false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2013-4286 is a false positive for org.apache.cxf:apache-cxf 3.5.11-tuxcare.13. false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu...", "vulnerability": { "name": "CVE-2013-4286" }, "impact_statement": "false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:apache-cxf 3.5.11-tuxcare.13. false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com...", "vulnerability": { "name": "CVE-2013-6357" }, "impact_statement": "false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf.", "vulnerability": { "name": "CVE-2014-0096" }, "action_statement": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2018-8039 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. CVE-2018-8039 is not present in Apache CXF 3.5.11-tuxcare.10. The vulnerable pattern (returning 'true' when hostname verification fails via reflection) was fixed in upstream commit fae6fabf9b by Apache, which was already present in the upstream release 3.5.11 before TuxCare onboarding. The target code correctly returns 'false' on exception (line 193 of HttpsURLConnectionFactory.java), ensuring connections are rejected when hostname verification fails with the deprecated com.sun.net.ssl stack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.5; < 3.1.16; >= 3.2.0, < 3.2.5; < 3.1.16), NVD (< 3.1.16; >= 3.2.0, < 3.2.5), cve.org (< 3.1.16; >= 3.2, < 3.2.5), Snyk (< 3.1.16; >= 3.2.0, < 3.2.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8039" }, "impact_statement": "CVE-2018-8039 is not present in Apache CXF 3.5.11-tuxcare.10. The vulnerable pattern (returning 'true' when hostname verification fails via reflection) was fixed in upstream commit fae6fabf9b by Apache, which was already present in the upstream release 3.5.11 before TuxCare onboarding. The target code correctly returns 'false' on exception (line 193 of HttpsURLConnectionFactory.java), ensuring connections are rejected when hostname verification fails with the deprecated com.sun.net.ssl stack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.5; < 3.1.16; >= 3.2.0, < 3.2.5; < 3.1.16), NVD (< 3.1.16; >= 3.2.0, < 3.2.5), cve.org (< 3.1.16; >= 3.2, < 3.2.5), Snyk (< 3.1.16; >= 3.2.0, < 3.2.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2019-12406 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. not_affected \u2014 CVE-2019-12406 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability (unbounded attachment count causing DoS) was fixed in upstream Apache CXF 3.3.4/3.2.11 by commit 6c3990144b (author: coheigea@apache.org). This fix was already present in the upstream release 3.5.11 that TuxCare onboarded, before any TuxCare modifications. The target contains the complete defense: ATTACHMENT_MAX_CO...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12406" }, "impact_statement": "not_affected \u2014 CVE-2019-12406 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability (unbounded attachment count causing DoS) was fixed in upstream Apache CXF 3.3.4/3.2.11 by commit 6c3990144b (author: coheigea@apache.org). This fix was already present in the upstream release 3.5.11 that TuxCare onboarded, before any TuxCare modifications. The target contains the complete defense: ATTACHMENT_MAX_CO..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2019-12423 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. CVE-2019-12423 is not present in Apache CXF 3.5.11-tuxcare.10. The vulnerability, which exposed private key parameters and secret keys through the OpenId Connect JWK Keys service when using JWK keystores, was fixed in upstream commit 6852cd5e49 by Apache developer Colm O hEigeartaigh (coheigea@apache.org). This fix was already present in the upstream Apache CXF 3.5.11 release that TuxCare onboarded, as confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit (b7acdd8c72). The fix adds mandatory stripping of RSA/EC private key parameters (d, p, q, dp, dq, qi) and complete exclusion of secret keys (oct type) from the JWK Keys service response through JwkUtils.stripPrivateParameters(), which is enabled by default (stripPrivateParameters=true in JwksService).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12423" }, "impact_statement": "CVE-2019-12423 is not present in Apache CXF 3.5.11-tuxcare.10. The vulnerability, which exposed private key parameters and secret keys through the OpenId Connect JWK Keys service when using JWK keystores, was fixed in upstream commit 6852cd5e49 by Apache developer Colm O hEigeartaigh (coheigea@apache.org). This fix was already present in the upstream Apache CXF 3.5.11 release that TuxCare onboarded, as confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit (b7acdd8c72). The fix adds mandatory stripping of RSA/EC private key parameters (d, p, q, dp, dq, qi) and complete exclusion of secret keys (oct type) from the JWK Keys service response through JwkUtils.stripPrivateParameters(), which is enabled by default (stripPrivateParameters=true in JwksService).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2019-17573 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. not_affected \u2014 CVE-2019-17573 is NOT present in Apache CXF 3.5.11-tuxcare.10. The reflected XSS vulnerability in the /services listing page was fixed in upstream Apache CXF and the fix was already present in the 3.5.11 release that TuxCare onboarded. The fix (commit ebf621e8b4) adds HTML entity escaping via StringEscapeUtils.escapeHtml4() to all endpoint URLs before they are written to the HTML services listi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17573" }, "impact_statement": "not_affected \u2014 CVE-2019-17573 is NOT present in Apache CXF 3.5.11-tuxcare.10. The reflected XSS vulnerability in the /services listing page was fixed in upstream Apache CXF and the fix was already present in the 3.5.11 release that TuxCare onboarded. The fix (commit ebf621e8b4) adds HTML entity escaping via StringEscapeUtils.escapeHtml4() to all endpoint URLs before they are written to the HTML services listi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2020-13954 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. not_affected \u2014 The target Apache CXF 3.5.11-tuxcare.10 is not affected by CVE-2020-13954 (reflected XSS via styleSheetPath parameter). The upstream fix (commit 3c23fa3b3c by Colm O hEigeartaigh, dated Sep 23, 2020) was already present in the Apache CXF 3.5.11 release that TuxCare onboarded. The fix applies HTML escaping using StringEscapeUtils.escapeHtml4() to the styleSheetPath parameter in FormattedServiceL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13954" }, "impact_statement": "not_affected \u2014 The target Apache CXF 3.5.11-tuxcare.10 is not affected by CVE-2020-13954 (reflected XSS via styleSheetPath parameter). The upstream fix (commit 3c23fa3b3c by Colm O hEigeartaigh, dated Sep 23, 2020) was already present in the Apache CXF 3.5.11 release that TuxCare onboarded. The fix applies HTML escaping using StringEscapeUtils.escapeHtml4() to the styleSheetPath parameter in FormattedServiceL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2021-22696 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. CVE-2021-22696 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability concerns insufficient validation of the OAuth 2.0 request_uri parameter, allowing attackers to trigger SSRF/DDoS by causing the authorization server to make outbound requests to arbitrary HTTPS URLs. The upstream fix (commits 40503a53 and aa789c5c by coheigea@apache.org on 2021-01-06) is present in HEAD: isRequestUriValid() returns false by default (disabling request_uri), and a SecurityException is thrown if both request and request_uri parameters are specified. These fixes were already in the upstream 3.5.11 release tag when TuxCare onboarded this version on 2025-12-09, confirmed by verifying both commits are ancestors of the first TuxCare commit b7acdd8c72.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22696" }, "impact_statement": "CVE-2021-22696 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability concerns insufficient validation of the OAuth 2.0 request_uri parameter, allowing attackers to trigger SSRF/DDoS by causing the authorization server to make outbound requests to arbitrary HTTPS URLs. The upstream fix (commits 40503a53 and aa789c5c by coheigea@apache.org on 2021-01-06) is present in HEAD: isRequestUriValid() returns false by default (disabling request_uri), and a SecurityException is thrown if both request and request_uri parameters are specified. These fixes were already in the upstream 3.5.11 release tag when TuxCare onboarded this version on 2025-12-09, confirmed by verifying both commits are ancestors of the first TuxCare commit b7acdd8c72.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2021-30468 does not affect version 3.5.11-tuxcare.13 of org.apache.cxf:apache-cxf. CVE-2021-30468 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability involved missing JSON escaping in JsonMapObjectReaderWriter, allowing malformed JSON with unescaped quotes to cause infinite loops during parsing. The fix (commit fa01cfac79, CXF-8435) was applied by Apache upstream on May 28, 2021, adding an escapeJson() method that escapes double quotes and backslashes before JSON output. This fix was already present in the upstream Apache CXF 3.5.11 release that TuxCare onboarded in December 2025, over 4 years after the fix. The target additionally includes a June 2021 improvement (commit f01fd3146d, CXF-8555) with more sophisticated escaping logic. Lines 93 and 134 of JsonMapObjectReaderWriter.java confirm proper escaping on all output paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-30468" }, "impact_statement": "CVE-2021-30468 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability involved missing JSON escaping in JsonMapObjectReaderWriter, allowing malformed JSON with unescaped quotes to cause infinite loops during parsing. The fix (commit fa01cfac79, CXF-8435) was applied by Apache upstream on May 28, 2021, adding an escapeJson() method that escapes double quotes and backslashes before JSON output. This fix was already present in the upstream Apache CXF 3.5.11 release that TuxCare onboarded in December 2025, over 4 years after the fix. The target additionally includes a June 2021 improvement (commit f01fd3146d, CXF-8555) with more sophisticated escaping logic. Lines 93 and 134 of JsonMapObjectReaderWriter.java confirm proper escaping on all output paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.11-tuxcare.13" } } ], "timestamp": "2026-11-12T17:09:44.826457+00:00", "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:apache-cxf 3.5.11-tuxcare.13. direct vulnerability is in Nu Html Checker (validator.nu) project", "vulnerability": { "name": "CVE-2025-15104" }, "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project" } ] }