{
  "@id": "urn:uuid:dfc14d7f-b294-49a0-93e2-79240768dd66",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:04:00.108193+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T09:03:00.103313+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T09:03:00.103313+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T09:03:00.103313+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T09:03:00.103313+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T09:03:00.103313+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T09:03:00.103313+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T09:03:00.103313+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "action_statement": "Vulnerability CVE-2026-34477 affects version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:04:00.108193+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api. not_affected \u2014 CVE-2026-34478 affects Log4j versions 2.21.0-2.25.3 due to configuration attribute renames introduced when Rfc5424Layout was migrated from factory method to builder pattern in 2.21.0. Target version 2.6.2 uses the original factory method pattern with documented attribute names (newLineEscape, useTlsMessageFormat) and never had the builder pattern or renamed attributes. The vulnerable code patte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-34478 affects Log4j versions 2.21.0-2.25.3 due to configuration attribute renames introduced when Rfc5424Layout was migrated from factory method to builder pattern in 2.21.0. Target version 2.6.2 uses the original factory method pattern with documented attribute names (newLineEscape, useTlsMessageFormat) and never had the builder pattern or renamed attributes. The vulnerable code patte..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:57:42.504133+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 does not affect version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api. not_affected \u2014 Version 2.6.2 is NOT AFFECTED by CVE-2026-34479. The vulnerable class `Log4j1XmlLayout` mentioned in the CVE does not exist in this version (it was introduced later in version 2.10.0). The only XML layout present in 2.6.2 is `XmlLayout`, which uses Jackson's `SanitizingXmlFactory` and was already protected by the CVE-2026-34480 backport (commit db02947e20) applied before the target release. Whi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34479"
      },
      "impact_statement": "not_affected \u2014 Version 2.6.2 is NOT AFFECTED by CVE-2026-34479. The vulnerable class `Log4j1XmlLayout` mentioned in the CVE does not exist in this version (it was introduced later in version 2.10.0). The only XML layout present in 2.6.2 is `XmlLayout`, which uses Jackson's `SanitizingXmlFactory` and was already protected by the CVE-2026-34480 backport (commit db02947e20) applied before the target release. Whi..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T09:06:00.127604+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-1.2-api@2.6.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:51:00.169047+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 does not affect version 2.6.2-tuxcare.1 of org.apache.logging.log4j:log4j-1.2-api. not_affected \u2014 Version 2.6.2 does not contain the vulnerable code pattern. CVE-2026-49844 affects versions 2.13.1+ where MapMessageJsonFormatter with complex data type support exists. Version 2.6.2 (released July 2016) predates this feature by ~4 years. In 2.6.2, MapMessage only handles String values (SortedMap<String, String>) and properly quotes all values during JSON serialization via StringBuilders.append...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "impact_statement": "not_affected \u2014 Version 2.6.2 does not contain the vulnerable code pattern. CVE-2026-49844 affects versions 2.13.1+ where MapMessageJsonFormatter with complex data type support exists. Version 2.6.2 (released July 2016) predates this feature by ~4 years. In 2.6.2, MapMessage only handles String values (SortedMap<String, String>) and properly quotes all values during JSON serialization via StringBuilders.append..."
    }
  ]
}