{
  "@id": "urn:uuid:384eca26-8dd0-4140-8f11-36c9d26c9b76",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:10:00.261159+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T18:35:46.430995+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:42:33.955731+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 does not affect version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui. not_affected \u2014 Version 2.8.2 is not affected by CVE-2026-34477. This CVE addresses the `verifyHostName` XML configuration attribute being silently ignored in Log4j Core versions 2.12.0 through 2.25.3. Version 2.8.2 (released April 2, 2017) predates the introduction of this configuration attribute entirely - the hostname verification feature was first added in May 2017 (LOG4J2-1442) and further developed in 2....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.2 is not affected by CVE-2026-34477. This CVE addresses the `verifyHostName` XML configuration attribute being silently ignored in Log4j Core versions 2.12.0 through 2.25.3. Version 2.8.2 (released April 2, 2017) predates the introduction of this configuration attribute entirely - the hostname verification feature was first added in May 2017 (LOG4J2-1442) and further developed in 2...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:10:00.261159+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui. not_affected \u2014 Version 2.8.2 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from factory method to builder pattern, inadvertently renaming security-relevant configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat, etc.). This caused user configurations using documented names to be silently ignored, leaving...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.2 is NOT affected by CVE-2026-34478. The vulnerability was introduced in version 2.21.0 when Rfc5424Layout was migrated from factory method to builder pattern, inadvertently renaming security-relevant configuration attributes (newLineEscape\u2192escapeNL, useTlsMessageFormat\u2192useTLSMessageFormat, etc.). This caused user configurations using documented names to be silently ignored, leaving..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2026-34479"
      },
      "action_statement": "Vulnerability CVE-2026-34479 affects version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:40:29.426671+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-jmx-gui@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:58:00.148214+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 does not affect version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-jmx-gui. not_affected \u2014 Target version 2.8.2 is NOT affected by CVE-2026-49844. The vulnerable code component (MapMessageJsonFormatter.java with unquoted non-finite numeric serialization) does not exist in this version. The target's MapMessage.asJson() implementation uses StringBuilders.appendDqValue() which always wraps ALL values in double quotes, making it architecturally impossible to produce malformed JSON output...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "impact_statement": "not_affected \u2014 Target version 2.8.2 is NOT affected by CVE-2026-49844. The vulnerable code component (MapMessageJsonFormatter.java with unquoted non-finite numeric serialization) does not exist in this version. The target's MapMessage.asJson() implementation uses StringBuilders.appendDqValue() which always wraps ALL values in double quotes, making it architecturally impossible to produce malformed JSON output..."
    }
  ]
}