{
  "@id": "urn:uuid:ab2d9279-e796-405e-a3e6-6f8aa7cc9f3a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T05:32:00.110255+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2005-4838 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2005-4838"
      },
      "impact_statement": "Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2007-1358 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. All 1 patch commits already exist in target branch",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1358"
      },
      "impact_statement": "All 1 patch commits already exist in target branch"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2008-0128 is a false positive for org.apache.cxf:cxf-core 3.5.9-tuxcare.14. false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing....",
      "vulnerability": {
        "name": "CVE-2008-0128"
      },
      "impact_statement": "false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2009-2696"
      },
      "impact_statement": "Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:cxf-core 3.5.9-tuxcare.14. false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository.",
      "vulnerability": {
        "name": "CVE-2010-1151"
      },
      "impact_statement": "false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2013-4444 is a false positive for org.apache.cxf:cxf-core 3.5.9-tuxcare.14. direct vulnerability is in Apache Tomcat project",
      "vulnerability": {
        "name": "CVE-2013-4444"
      },
      "impact_statement": "direct vulnerability is in Apache Tomcat project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:cxf-core 3.5.9-tuxcare.14. false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository.",
      "vulnerability": {
        "name": "CVE-2013-6357"
      },
      "impact_statement": "false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2014-0035 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0035 describes a vulnerability where UsernameToken credentials are transmitted in cleartext when EncryptBeforeSigning is enabled with EncryptedSupportingToken policy in Apache CXF SymmetricBinding. The fix (CXF-5046) was committed to upstream Apache CXF in May 2013 by Colm O Heigeartaigh. Version 3.5.9 includes this fix as it was already present in the upstream release that TuxCare onb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0035"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0035 describes a vulnerability where UsernameToken credentials are transmitted in cleartext when EncryptBeforeSigning is enabled with EncryptedSupportingToken policy in Apache CXF SymmetricBinding. The fix (CXF-5046) was committed to upstream Apache CXF in May 2013 by Colm O Heigeartaigh. Version 3.5.9 includes this fix as it was already present in the upstream release that TuxCare onb..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2014-0109 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0109 is not present in Apache CXF 3.5.9. The vulnerability, which allowed DoS via memory exhaustion when large text/html requests were sent to SOAP endpoints, was fixed upstream by Apache in February 2014 (commit 6dd839af). The fix adds a server-side check that prevents reading request bodies during error handling when text/html content-type is received. This protection has been in the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0109"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0109 is not present in Apache CXF 3.5.9. The vulnerability, which allowed DoS via memory exhaustion when large text/html requests were sent to SOAP endpoints, was fixed upstream by Apache in February 2014 (commit 6dd839af). The fix adds a server-side check that prevents reading request bodies during error handling when text/html content-type is received. This protection has been in the..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2014-0110 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0110 is not a vulnerability in Apache CXF 3.5.9-tuxcare.10. The upstream fix (commit c1e3bfd43e from October 2011) added a configurable maxSize limit to CachedOutputStream that prevents unlimited disk consumption from large SOAP messages. The defense code exists in the target (enforceLimits() method at lines 439-446 throws CacheSizeExceededException when maxSize > 0 and totalLength > m...",
      "vulnerability": {
        "name": "CVE-2014-0110"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0110 is not a vulnerability in Apache CXF 3.5.9-tuxcare.10. The upstream fix (commit c1e3bfd43e from October 2011) added a configurable maxSize limit to CachedOutputStream that prevents unlimited disk consumption from large SOAP messages. The defense code exists in the target (enforceLimits() method at lines 439-446 throws CacheSizeExceededException when maxSize > 0 and totalLength > m..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2014-0119 is a false positive for org.apache.cxf:cxf-core 3.5.9-tuxcare.14. direct vulnerability is in Apache Tomcat project",
      "vulnerability": {
        "name": "CVE-2014-0119"
      },
      "impact_statement": "direct vulnerability is in Apache Tomcat project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2016-6812 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2016-6812 is not present in Apache CXF 3.5.9-tuxcare.10. The vulnerability allowed XSS via matrix parameters (;key=value) in URLs that would be reflected in the service list HTML page. The fixes for this vulnerability (CXF-6216) were authored by upstream Apache CXF developer Sergey Beryozkin and shipped in the upstream 3.5.9 release before TuxCare onboarded it. The target contains comprehen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6812"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6812 is not present in Apache CXF 3.5.9-tuxcare.10. The vulnerability allowed XSS via matrix parameters (;key=value) in URLs that would be reflected in the service list HTML page. The fixes for this vulnerability (CXF-6216) were authored by upstream Apache CXF developer Sergey Beryozkin and shipped in the upstream 3.5.9 release before TuxCare onboarded it. The target contains comprehen..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2016-8739 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. CVE-2016-8739 XXE vulnerability is NOT present in Apache CXF 3.5.9-tuxcare.10. The upstream fix (commit d9e2a6e726 by Sergey Beryozkin, dated Nov 23, 2016) was already shipped in the upstream release 3.5.9 that TuxCare onboarded. The target uses StaxUtils.createXMLStreamReader() which creates a secure XMLStreamReader with external entity resolution disabled via multiple mechanisms: SUPPORT_DTD=false, IS_REPLACING_ENTITY_REFERENCES=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and an XMLResolver that throws exceptions on entity resolution attempts.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.12; >= 3.1.0, < 3.1.9), NVD (<= 3.0.11; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8), cve.org (< 3.0.12; >= 3.1, < 3.1.9), Snyk (>= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8739"
      },
      "impact_statement": "CVE-2016-8739 XXE vulnerability is NOT present in Apache CXF 3.5.9-tuxcare.10. The upstream fix (commit d9e2a6e726 by Sergey Beryozkin, dated Nov 23, 2016) was already shipped in the upstream release 3.5.9 that TuxCare onboarded. The target uses StaxUtils.createXMLStreamReader() which creates a secure XMLStreamReader with external entity resolution disabled via multiple mechanisms: SUPPORT_DTD=false, IS_REPLACING_ENTITY_REFERENCES=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and an XMLResolver that throws exceptions on entity resolution attempts.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.12; >= 3.1.0, < 3.1.9), NVD (<= 3.0.11; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8), cve.org (< 3.0.12; >= 3.1, < 3.1.9), Snyk (>= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2017-12624 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2017-12624 is NOT present in Apache CXF 3.5.9-tuxcare.10. The upstream vendor (Apache) fix for this DoS vulnerability via unbounded attachment header parsing was already included in the upstream release before TuxCare's extended lifecycle support began. The fix limits attachment header lines to 300 characters (configurable) and is active by default.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12624"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-12624 is NOT present in Apache CXF 3.5.9-tuxcare.10. The upstream vendor (Apache) fix for this DoS vulnerability via unbounded attachment header parsing was already included in the upstream release before TuxCare's extended lifecycle support began. The fix limits attachment header lines to 300 characters (configurable) and is active by default."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2017-5653 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. not_affected \u2014 The target Apache CXF version 3.5.9-tuxcare.10 is NOT affected by CVE-2017-5653. The vulnerability (JAX-RS XML Security streaming clients not validating signed/encrypted service responses) was fixed by upstream Apache CXF in commit fade9b81dabe27f864ca38e7b40f28fb44d6f165 dated March 27, 2017. This fix was already present in the upstream Apache CXF 3.5.9 release before TuxCare began maintaining...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5653"
      },
      "impact_statement": "not_affected \u2014 The target Apache CXF version 3.5.9-tuxcare.10 is NOT affected by CVE-2017-5653. The vulnerability (JAX-RS XML Security streaming clients not validating signed/encrypted service responses) was fixed by upstream Apache CXF in commit fade9b81dabe27f864ca38e7b40f28fb44d6f165 dated March 27, 2017. This fix was already present in the upstream Apache CXF 3.5.9 release before TuxCare began maintaining..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2017-5656 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. Apache CXF 3.5.9-tuxcare.10 is NOT vulnerable to CVE-2017-5656. The vulnerability involved flawed token ID extraction in DefaultSTSTokenCacher.getIdFromToken() that blindly trusted Id/ID/AssertionID attributes from any delegation token, allowing attackers to craft tokens that collide with other users' cached tokens. The fix (commit 66c2c5b99e, April 2017) validates token types before extracting IDs and hashes BinarySecurityTokens. This fix was applied by Apache upstream and was already present in Apache CXF 3.5.9 (released well after 3.1.11, the last affected version) before TuxCare onboarded it. The target's getIdFromToken() method (lines 162-200) contains the complete fix with type-specific ID extraction logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.1.0, < 3.1.11; < 3.0.13), NVD (>= 3.0.0, < 3.0.13; >= 3.1.0, < 3.1.11), cve.org (>= 3.1, < 3.1.11; < 3.0.13), Snyk (< 3.0.14; >= 3.1.0, < 3.1.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5656"
      },
      "impact_statement": "Apache CXF 3.5.9-tuxcare.10 is NOT vulnerable to CVE-2017-5656. The vulnerability involved flawed token ID extraction in DefaultSTSTokenCacher.getIdFromToken() that blindly trusted Id/ID/AssertionID attributes from any delegation token, allowing attackers to craft tokens that collide with other users' cached tokens. The fix (commit 66c2c5b99e, April 2017) validates token types before extracting IDs and hashes BinarySecurityTokens. This fix was applied by Apache upstream and was already present in Apache CXF 3.5.9 (released well after 3.1.11, the last affected version) before TuxCare onboarded it. The target's getIdFromToken() method (lines 162-200) contains the complete fix with type-specific ID extraction logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.1.0, < 3.1.11; < 3.0.13), NVD (>= 3.0.0, < 3.0.13; >= 3.1.0, < 3.1.11), cve.org (>= 3.1, < 3.1.11; < 3.0.13), Snyk (< 3.0.14; >= 3.1.0, < 3.1.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2022-46363 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. CVE-2022-46363 is not present in Apache CXF 3.5.9-tuxcare.10. The vulnerability allowed remote directory listing when both static-resources-list and redirect-query-check attributes were configured together, by incorrectly including query strings in static resource path matching. The upstream fix (commit a1b5578cf9) was already included in Apache CXF 3.5.9 when TuxCare onboarded it. The fix changes the matchPath method to accept an explicit boolean parameter, ensuring static resources matching always ignores query strings (passes false) while redirect matching respects the redirectQueryCheck flag. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0, < 3.5.5), NVD (< 3.4.10; >= 3.5.0, < 3.5.5), cve.org (>= 3.5, < 3.5.5; >= 3.4, < 3.4.10), Snyk (< 3.4.10; >= 3.5.0, < 3.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-46363"
      },
      "impact_statement": "CVE-2022-46363 is not present in Apache CXF 3.5.9-tuxcare.10. The vulnerability allowed remote directory listing when both static-resources-list and redirect-query-check attributes were configured together, by incorrectly including query strings in static resource path matching. The upstream fix (commit a1b5578cf9) was already included in Apache CXF 3.5.9 when TuxCare onboarded it. The fix changes the matchPath method to accept an explicit boolean parameter, ensuring static resources matching always ignores query strings (passes false) while redirect matching respects the redirectQueryCheck flag. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0, < 3.5.5), NVD (< 3.4.10; >= 3.5.0, < 3.5.5), cve.org (>= 3.5, < 3.5.5; >= 3.4, < 3.4.10), Snyk (< 3.4.10; >= 3.5.0, < 3.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2022-46364 does not affect version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core. The target Apache CXF 3.5.9-tuxcare.10 is NOT AFFECTED by CVE-2022-46364. The vulnerability (SSRF via XOP:Include href attribute) was fixed in upstream Apache CXF 3.5.5, and the target version 3.5.9 already contains this upstream fix. The fix was authored by Andriy Redko (drreta@gmail.com) and was present in the upstream 3.5.9 release before TuxCare onboarded the version. The vulnerable code pattern (unconditional URL following in AttachmentUtil.getAttachmentDataSource) is not present in the target; instead, the fixed code includes a system property check (ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY, default \"false\") that prevents following arbitrary URLs by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0, < 3.5.5), NVD (< 3.4.10; >= 3.5.0, < 3.5.5), cve.org (< 3.5.5; < 3.4.10), Snyk (< 3.4.10; >= 3.5.0, < 3.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-46364"
      },
      "impact_statement": "The target Apache CXF 3.5.9-tuxcare.10 is NOT AFFECTED by CVE-2022-46364. The vulnerability (SSRF via XOP:Include href attribute) was fixed in upstream Apache CXF 3.5.5, and the target version 3.5.9 already contains this upstream fix. The fix was authored by Andriy Redko (drreta@gmail.com) and was present in the upstream 3.5.9 release before TuxCare onboarded the version. The vulnerable code pattern (unconditional URL following in AttachmentUtil.getAttachmentDataSource) is not present in the target; instead, the fixed code includes a system property check (ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY, default \"false\") that prevents following arbitrary URLs by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0, < 3.5.5), NVD (< 3.4.10; >= 3.5.0, < 3.5.5), cve.org (< 3.5.5; < 3.4.10), Snyk (< 3.4.10; >= 3.5.0, < 3.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:cxf-core 3.5.9-tuxcare.14. direct vulnerability is in Nu Html Checker (validator.nu) project",
      "vulnerability": {
        "name": "CVE-2025-15104"
      },
      "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2025-23184 is fixed in version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2025-23184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2025-48795 is fixed in version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2025-48795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2026-107937 affects version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-107937"
      },
      "action_statement": "Vulnerability CVE-2026-107937 affects version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2026-108039 is fixed in version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-108039"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2026-49875 is fixed in version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-49875"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2026-50645 is fixed in version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-50645"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2026-54225 affects version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-54225"
      },
      "action_statement": "Vulnerability CVE-2026-54225 affects version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2026-64958 is fixed in version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-64958"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.9-tuxcare.14"
          }
        }
      ],
      "timestamp": "2026-11-10T10:49:12.999658+00:00",
      "status_notes": "Vulnerability CVE-2026-78384 is fixed in version 3.5.9-tuxcare.14 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-78384"
      }
    }
  ]
}