{
  "@id": "urn:uuid:468fa8b9-816f-4854-99bf-f1cd4c986e04",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:16:16.415526+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2017-5645 affects TcpSocketServer and UdpSocketServer classes that receive serialized log events over network sockets. These classes do not exist in the target repository at version 2.11.1. The vulnerability was fixed in upstream version 2.8.2 (commit 5dcc192158, March 2017), and the affected classes were subsequently moved to a separate Tools repository (commit 8865124fb1, April 2017). Both changes occurred before version 2.11.1 was released. The target version never contained the vulnerable code path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "CVE-2017-5645 affects TcpSocketServer and UdpSocketServer classes that receive serialized log events over network sockets. These classes do not exist in the target repository at version 2.11.1. The vulnerability was fixed in upstream version 2.8.2 (commit 5dcc192158, March 2017), and the affected classes were subsequently moved to a separate Tools repository (commit 8865124fb1, April 2017). Both changes occurred before version 2.11.1 was released. The target version never contained the vulnerable code path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:16:14.545586+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:16:14.545586+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:16:14.545586+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:16:14.545586+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:16:14.545586+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 explicitly affects \"Apache Log4j before 2\" (Log4j 1.x only). The target is Log4j 2.11.1, which does not contain the vulnerable components. The Chainsaw receiver component and SocketServer from Log4j 1.x that performed unbounded ObjectInputStream deserialization of network-received log events do not exist in Log4j 2.x. Log4j 2.x only has outbound SocketAppender (sends logs) with no corresponding network receiver components. Exhaustive search confirmed no server/receiver components exist that would accept incoming serialized log events over the network, breaking the attack chain at the entry point.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "impact_statement": "CVE-2023-26464 explicitly affects \"Apache Log4j before 2\" (Log4j 1.x only). The target is Log4j 2.11.1, which does not contain the vulnerable components. The Chainsaw receiver component and SocketServer from Log4j 1.x that performed unbounded ObjectInputStream deserialization of network-received log events do not exist in Log4j 2.x. Log4j 2.x only has outbound SocketAppender (sends logs) with no corresponding network receiver components. Exhaustive search confirmed no server/receiver components exist that would accept incoming serialized log events over the network, breaking the attack chain at the entry point.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:16:14.545586+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:42:05.699209+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 does not affect version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.11.1 is not affected by CVE-2026-34477. The vulnerability concerns the `verifyHostName` XML attribute being silently ignored in versions 2.12.0-2.25.3. This attribute was introduced in Log4j Core 2.12.0, so version 2.11.1 (which predates this feature) does not have the XML attribute, the 4-parameter factory method, or the plugin infrastructure needed to exhibit this bug. Rule 5 Type A...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.1 is not affected by CVE-2026-34477. The vulnerability concerns the `verifyHostName` XML attribute being silently ignored in versions 2.12.0-2.25.3. This attribute was introduced in Log4j Core 2.12.0, so version 2.11.1 (which predates this feature) does not have the XML attribute, the 4-parameter factory method, or the plugin infrastructure needed to exhibit this bug. Rule 5 Type A..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T08:06:00.284884+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Target version 2.11.1 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout migrated from factory method to builder pattern, silently renaming security-critical configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat). This caused existing user configurations to be ignored, disabling CRLF injection defenses. Ve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Target version 2.11.1 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout migrated from factory method to builder pattern, silently renaming security-critical configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat). This caused existing user configurations to be ignored, disabling CRLF injection defenses. Ve..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:16:14.545586+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T10:20:00.920285+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.11.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    }
  ]
}