{
  "@id": "urn:uuid:82c14c0d-25ea-4024-8bb2-da03af6755c7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:05:00.153344+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:51:39.111713+00:00",
      "status_notes": "Vulnerability CVE-2025-27820 does not affect version 5.4.4-tuxcare.2 of org.apache.httpcomponents.client5:httpclient5. CVE-2025-27820 affects Apache HttpClient 5.4.x due to a missing leading slash in the PUBLIC_SUFFIX_LIST resource path, which causes the Public Suffix List data to fail loading. This disables domain validation checks for cookie management and host name verification. The vulnerability was introduced in commit 648690fdf (Aug 2024) and fixed in commit bff9c4772 (Mar 2025) by adding the leading slash. The target repository at version 5.4.4-tuxcare.1 already contains the upstream fix, as commit bff9c4772 was part of the upstream 5.4.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4-alpha1, < 5.4.3), NVD (>= 5.4, < 5.4.3), cve.org (>= 5.4.0, < 5.4.3), Snyk (>= 5.4.0, < 5.4.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-27820"
      },
      "impact_statement": "CVE-2025-27820 affects Apache HttpClient 5.4.x due to a missing leading slash in the PUBLIC_SUFFIX_LIST resource path, which causes the Public Suffix List data to fail loading. This disables domain validation checks for cookie management and host name verification. The vulnerability was introduced in commit 648690fdf (Aug 2024) and fixed in commit bff9c4772 (Mar 2025) by adding the leading slash. The target repository at version 5.4.4-tuxcare.1 already contains the upstream fix, as commit bff9c4772 was part of the upstream 5.4.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4-alpha1, < 5.4.3), NVD (>= 5.4, < 5.4.3), cve.org (>= 5.4.0, < 5.4.3), Snyk (>= 5.4.0, < 5.4.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:05:00.153344+00:00",
      "status_notes": "Vulnerability CVE-2026-40542 does not affect version 5.4.4-tuxcare.2 of org.apache.httpcomponents.client5:httpclient5. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.4.4 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-v468-qcjx-r72w (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40542"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.4.4 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-v468-qcjx-r72w (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:51:39.111713+00:00",
      "status_notes": "Vulnerability CVE-2026-64607 is fixed in version 5.4.4-tuxcare.2 of org.apache.httpcomponents.client5:httpclient5.",
      "vulnerability": {
        "name": "CVE-2026-64607"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:51:39.111713+00:00",
      "status_notes": "Vulnerability CVE-2026-71290 is fixed in version 5.4.4-tuxcare.2 of org.apache.httpcomponents.client5:httpclient5.",
      "vulnerability": {
        "name": "CVE-2026-71290"
      }
    }
  ]
}