{
  "@id": "urn:uuid:8a5b459d-babe-46ab-bd6a-00b5fa4cddb3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T11:43:44.581245+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.poi/poi-examples@4.1.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.poi/poi-examples@4.1.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T11:43:44.581245+00:00",
      "status_notes": "Vulnerability CVE-2016-5000 does not affect version 4.1.2-tuxcare.4 of org.apache.poi:poi-examples. not_affected \u2014 CVE-2016-5000 (XXE in XLSX2CSV example) is NOT present in Apache POI 4.1.2. The vulnerable pattern (unsafe XML parsing without external entity protection) was fixed in upstream commit 08159e66a7 by Andreas Beeker, which changed XLSX2CSV.java to use XMLHelper.newXMLReader(). This method disables external entity processing via FEATURE_EXTERNAL_ENTITIES=false and sets an entity resolver that retur...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5000"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-5000 (XXE in XLSX2CSV example) is NOT present in Apache POI 4.1.2. The vulnerable pattern (unsafe XML parsing without external entity protection) was fixed in upstream commit 08159e66a7 by Andreas Beeker, which changed XLSX2CSV.java to use XMLHelper.newXMLReader(). This method disables external entity processing via FEATURE_EXTERNAL_ENTITIES=false and sets an entity resolver that retur..."
    }
  ]
}