{
  "@id": "urn:uuid:f2bf5e4c-2dc2-4548-8b44-5f9f583c8bac",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:07:56.784941+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 is fixed in version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 is fixed in version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "action_statement": "Vulnerability CVE-2026-34477 affects version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T08:07:56.784941+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api. not_affected \u2014 Apache Log4j Core version 2.5 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from factory method pattern to builder pattern, causing documented configuration attribute names to be silently renamed. Version 2.5 predates this migration and uses the original factory method pattern with the correct, documented attribute names (n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Apache Log4j Core version 2.5 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from factory method pattern to builder pattern, causing documented configuration attribute names to be silently renamed. Version 2.5 predates this migration and uses the original factory method pattern with the correct, documented attribute names (n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:56:47.729906+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 does not affect version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api. not_affected \u2014 CVE-2026-34479 affects Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge. This component was introduced in Log4j version 2.7 (commit 8e01bde35d on 2016-08-14) and does not exist in the target version 2.5. The target repository is Apache Log4j 2 (correct product), but the specific vulnerable component Log4j1XmlLayout was not yet introduced at this version. While the Transform.java utilit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34479"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-34479 affects Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge. This component was introduced in Log4j version 2.7 (commit 8e01bde35d on 2016-08-14) and does not exist in the target version 2.5. The target repository is Apache Log4j 2 (correct product), but the specific vulnerable component Log4j1XmlLayout was not yet introduced at this version. While the Transform.java utilit..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T11:53:00.170447+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 does not affect version 2.5-tuxcare.2 of org.apache.logging.log4j:log4j-1.2-api. not_affected \u2014 Version 2.5 is not affected by CVE-2026-49844. The vulnerability concerns improper JSON encoding of non-finite floating-point values (NaN, Infinity, -Infinity) in MapMessage, but version 2.5's MapMessage only supports String values and cannot hold floating-point types. The vulnerable code path (MapMessageJsonFormatter handling numeric types) doesn't exist in this version. The CVE's affected ran...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "impact_statement": "not_affected \u2014 Version 2.5 is not affected by CVE-2026-49844. The vulnerability concerns improper JSON encoding of non-finite floating-point values (NaN, Infinity, -Infinity) in MapMessage, but version 2.5's MapMessage only supports String values and cannot hold floating-point types. The vulnerable code path (MapMessageJsonFormatter handling numeric types) doesn't exist in this version. The CVE's affected ran..."
    }
  ]
}