{
  "@id": "urn:uuid:8c9f3093-4477-4da4-a2e1-11b8bf23733e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T13:07:12.511442+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. The target repository (Apache Log4j 2.9.1) is not affected by CVE-2017-5645. The vulnerable server components (TcpSocketServer, UdpSocketServer) that receive and deserialize objects over TCP/UDP sockets were completely removed from the codebase before the 2.9.1 release. Git history shows these components were moved to a separate Tools repository in commit 8865124fb1, which is an ancestor of both the upstream 2.9.1 release tag (fc3104171c) and the current HEAD. The input handler for serialized objects over network sockets does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "impact_statement": "The target repository (Apache Log4j 2.9.1) is not affected by CVE-2017-5645. The vulnerable server components (TcpSocketServer, UdpSocketServer) that receive and deserialize objects over TCP/UDP sockets were completely removed from the codebase before the 2.9.1 release. Git history shows these components were moved to a separate Tools repository in commit 8865124fb1, which is an ancestor of both the upstream 2.9.1 release tag (fc3104171c) and the current HEAD. The input handler for serialized objects over network sockets does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T13:07:12.511442+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.9.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core, and is fixed in 2.9.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. Log4j 2.9.1 is not affected by CVE-2023-26464. This CVE explicitly targets Log4j 1.x (before version 2) and involves deserialization vulnerabilities in Chainsaw and SocketAppender components when receiving network log events. Log4j 2.9.1 has a fundamentally different architecture: (1) No Chainsaw component exists, (2) SocketAppender is a sender-only component that does not receive or deserialize network data, (3) Log4j 2.x uses a LogEventProxy pattern with defensive deserialization that throws InvalidObjectException, and (4) no equivalent receiver component exists that would create the vulnerable code path present in Log4j 1.x. The CVE description explicitly states \"This issue affects Apache Log4j before 2\" - Log4j 2.x versions were intentionally excluded from the vulnerability scope.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "impact_statement": "Log4j 2.9.1 is not affected by CVE-2023-26464. This CVE explicitly targets Log4j 1.x (before version 2) and involves deserialization vulnerabilities in Chainsaw and SocketAppender components when receiving network log events. Log4j 2.9.1 has a fundamentally different architecture: (1) No Chainsaw component exists, (2) SocketAppender is a sender-only component that does not receive or deserialize network data, (3) Log4j 2.x uses a LogEventProxy pattern with defensive deserialization that throws InvalidObjectException, and (4) no equivalent receiver component exists that would create the vulnerable code path present in Log4j 1.x. The CVE description explicitly states \"This issue affects Apache Log4j before 2\" - Log4j 2.x versions were intentionally excluded from the vulnerability scope.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 does not affect version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.9.1 is NOT AFFECTED by CVE-2026-34477. This CVE specifically addresses the verifyHostName XML configuration attribute (introduced in Log4j 2.12.0) being silently ignored in versions 2.12.0-2.25.3. Since version 2.9.1 predates the introduction of this feature, the vulnerable code pattern (attribute parsing that ignores the verifyHostName value) does not exist in this version. The targe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "impact_statement": "not_affected \u2014 Version 2.9.1 is NOT AFFECTED by CVE-2026-34477. This CVE specifically addresses the verifyHostName XML configuration attribute (introduced in Log4j 2.12.0) being silently ignored in versions 2.12.0-2.25.3. Since version 2.9.1 predates the introduction of this feature, the vulnerable code pattern (attribute parsing that ignores the verifyHostName value) does not exist in this version. The targe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.9.1 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from a factory method to the builder pattern, and configuration attributes were silently renamed. Version 2.9.1 predates this refactoring and correctly recognizes all documented attribute names (newLineEscape, useTlsMessageFormat, mdcRequired, mdcIncludes, mdcExclu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.9.1 is not affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from a factory method to the builder pattern, and configuration attributes were silently renamed. Version 2.9.1 predates this refactoring and correctly recognizes all documented attribute names (newLineEscape, useTlsMessageFormat, mdcRequired, mdcIncludes, mdcExclu..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:33.632007+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 is fixed in version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.9.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:45:23.648147+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.9.1-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    }
  ]
}