{
  "@id": "urn:uuid:491707eb-b485-44f8-a2b6-58c7a0ae5773",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:01:20.989527+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.maven/maven-core@3.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.maven/maven-core@3.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:01:20.989527+00:00",
      "status_notes": "Vulnerability CVE-2021-26291 does not affect version 3.9.9-tuxcare.1 of org.apache.maven:maven-core. Maven 3.9.9 is not affected by CVE-2021-26291. The vulnerability was fixed in Maven 3.8.1+ by blocking HTTP (non-SSL) repositories by default. The target version 3.9.9 already includes the complete upstream fix (commits 907d53ad32, 899465aeec, fa79cb22e4) authored by Apache committer Herv\u00e9 Boutemy, which shipped in the upstream 3.9.9 release that TuxCare subsequently onboarded. The fix includes: (1) default mirror configuration blocking external HTTP repositories via pattern 'external:http:*', (2) isExternalHttpRepo() validation logic in mirror selectors, and (3) blocked mirror support in the settings model. All defense components are present and active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-26291"
      },
      "impact_statement": "Maven 3.9.9 is not affected by CVE-2021-26291. The vulnerability was fixed in Maven 3.8.1+ by blocking HTTP (non-SSL) repositories by default. The target version 3.9.9 already includes the complete upstream fix (commits 907d53ad32, 899465aeec, fa79cb22e4) authored by Apache committer Herv\u00e9 Boutemy, which shipped in the upstream 3.9.9 release that TuxCare subsequently onboarded. The fix includes: (1) default mirror configuration blocking external HTTP repositories via pattern 'external:http:*', (2) isExternalHttpRepo() validation logic in mirror selectors, and (3) blocked mirror support in the settings model. All defense components are present and active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1)."
    }
  ]
}