{
  "@id": "urn:uuid:a078f506-4f5d-49a7-97c3-6c7b31e25168",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:04:00.121073+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:29:31.477851+00:00",
      "status_notes": "Vulnerability CVE-2025-27820 affects version 5.3.1-tuxcare.1 of org.apache.httpcomponents.client5:httpclient5.",
      "vulnerability": {
        "name": "CVE-2025-27820"
      },
      "action_statement": "Vulnerability CVE-2025-27820 affects version 5.3.1-tuxcare.1 of org.apache.httpcomponents.client5:httpclient5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:04:00.121073+00:00",
      "status_notes": "Vulnerability CVE-2026-40542 does not affect version 5.3.1-tuxcare.1 of org.apache.httpcomponents.client5:httpclient5. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.3.1 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-v468-qcjx-r72w (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40542"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.3.1 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-v468-qcjx-r72w (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-64607 is fixed in version 5.3.1-tuxcare.1 of org.apache.httpcomponents.client5:httpclient5.",
      "vulnerability": {
        "name": "CVE-2026-64607"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.3.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T23:02:35.074453+00:00",
      "status_notes": "Vulnerability CVE-2026-71290 does not affect version 5.3.1-tuxcare.1 of org.apache.httpcomponents.client5:httpclient5. not_affected \u2014 Version 5.3.1 is not affected by CVE-2026-71290. The vulnerability is specific to the HostnameVerificationPolicy.BUILTIN feature introduced in version 5.4+, where a parameter ordering bug caused hostname verification to be skipped in async TLS connections. Version 5.3.1 does not have this feature and instead uses a different, correctly-implemented post-handshake hostname verification mechanism ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-71290"
      },
      "impact_statement": "not_affected \u2014 Version 5.3.1 is not affected by CVE-2026-71290. The vulnerability is specific to the HostnameVerificationPolicy.BUILTIN feature introduced in version 5.4+, where a parameter ordering bug caused hostname verification to be skipped in async TLS connections. Version 5.3.1 does not have this feature and instead uses a different, correctly-implemented post-handshake hostname verification mechanism ..."
    }
  ]
}