{
  "@id": "urn:uuid:1eda3892-e477-4a7d-a17b-6310eaa4734f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T10:27:37.551355+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T12:36:58.202659+00:00",
      "status_notes": "Vulnerability CVE-2018-12537 does not affect version 4.3.8-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12537 affects Eclipse Vert.x 3.0 to 3.5.1 due to missing CR/LF filtering in HTTP headers, allowing header injection attacks. The target repository (io.vertx:vertx-core version 4.3.8-tuxcare.1) is not affected because the vulnerability was fixed in upstream Vert.x 3.6.0 (October 2018) via commit fa03a8e70 by Julien Viet. The fix introduced HttpUtils.validateHeaderValue() which validates...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12537"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12537 affects Eclipse Vert.x 3.0 to 3.5.1 due to missing CR/LF filtering in HTTP headers, allowing header injection attacks. The target repository (io.vertx:vertx-core version 4.3.8-tuxcare.1) is not affected because the vulnerability was fixed in upstream Vert.x 3.6.0 (October 2018) via commit fa03a8e70 by Julien Viet. The fix introduced HttpUtils.validateHeaderValue() which validates..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T12:36:58.202659+00:00",
      "status_notes": "Vulnerability CVE-2018-12541 does not affect version 4.3.8-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 Target version 4.3.8 is not affected by CVE-2018-12541. The vulnerability (unbounded buffering of WebSocket upgrade request bodies leading to memory exhaustion DoS) was fixed in upstream commit eebd62c639 by Julien Viet on 2020-09-08. The fix enforces an 8192-byte limit on request bodies during WebSocket upgrade and returns HTTP 413 for oversized requests, exactly as specified in the CVE. This ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12541"
      },
      "impact_statement": "not_affected \u2014 Target version 4.3.8 is not affected by CVE-2018-12541. The vulnerability (unbounded buffering of WebSocket upgrade request bodies leading to memory exhaustion DoS) was fixed in upstream commit eebd62c639 by Julien Viet on 2020-09-08. The fix enforces an 8192-byte limit on request bodies during WebSocket upgrade and returns HTTP 413 for oversized requests, exactly as specified in the CVE. This ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T12:36:58.202659+00:00",
      "status_notes": "Vulnerability CVE-2018-12544 is a false positive for io.vertx:vertx-core 4.3.8-tuxcare.2. false_positive \u2014 CVE-2018-12544 is a wrong-project match. This repository is Eclipse Vert.x Core (vertx-core) version 4.3.8, which provides low-level HTTP, TCP, and file system functionality. The CVE specifically targets the \"Eclipse Vert.x OpenAPI XML type validator\" component, which exists in a separate module (vertx-web-api-contract in 3.x versions, later vertx-web-openapi). Exhaustive containment searches c...",
      "vulnerability": {
        "name": "CVE-2018-12544"
      },
      "impact_statement": "false_positive \u2014 CVE-2018-12544 is a wrong-project match. This repository is Eclipse Vert.x Core (vertx-core) version 4.3.8, which provides low-level HTTP, TCP, and file system functionality. The CVE specifically targets the \"Eclipse Vert.x OpenAPI XML type validator\" component, which exists in a separate module (vertx-web-api-contract in 3.x versions, later vertx-web-openapi). Exhaustive containment searches c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:37.551355+00:00",
      "status_notes": "Vulnerability CVE-2024-1023 does not affect version 4.3.8-tuxcare.2 of io.vertx:vertx-core. Prechecker: no vulnerable code from the patch was found, and this version calls none of the distinctive methods on the lines the fix removes. Advisories: GitHub, cve.org (Red Hat) and Snyk list only 4.4.5, 4.4.6, 4.5.0 and 4.5.1 as affected, so this version is older; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-1023"
      },
      "impact_statement": "Prechecker: no vulnerable code from the patch was found, and this version calls none of the distinctive methods on the lines the fix removes. Advisories: GitHub, cve.org (Red Hat) and Snyk list only 4.4.5, 4.4.6, 4.5.0 and 4.5.1 as affected, so this version is older; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T12:36:58.202659+00:00",
      "status_notes": "Vulnerability CVE-2024-1300 affects version 4.3.8-tuxcare.2 of io.vertx:vertx-core.",
      "vulnerability": {
        "name": "CVE-2024-1300"
      },
      "action_statement": "Vulnerability CVE-2024-1300 affects version 4.3.8-tuxcare.2 of io.vertx:vertx-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T12:36:58.202659+00:00",
      "status_notes": "Vulnerability CVE-2026-1002 affects version 4.3.8-tuxcare.2 of io.vertx:vertx-core.",
      "vulnerability": {
        "name": "CVE-2026-1002"
      },
      "action_statement": "Vulnerability CVE-2026-1002 affects version 4.3.8-tuxcare.2 of io.vertx:vertx-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T12:36:58.202659+00:00",
      "status_notes": "Vulnerability CVE-2026-6860 affects version 4.3.8-tuxcare.2 of io.vertx:vertx-core.",
      "vulnerability": {
        "name": "CVE-2026-6860"
      },
      "action_statement": "Vulnerability CVE-2026-6860 affects version 4.3.8-tuxcare.2 of io.vertx:vertx-core."
    }
  ]
}