{
  "@id": "urn:uuid:07296f7f-238e-4944-868e-ce1e052a552c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T02:46:00.035379+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2005-4838 is a false positive for org.apache.cxf:cxf-core 3.5.11-tuxcare.4. false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository.",
      "vulnerability": {
        "name": "CVE-2005-4838"
      },
      "impact_statement": "false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2006-7196 is a false positive for org.apache.cxf:cxf-core 3.5.11-tuxcare.4. false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository.",
      "vulnerability": {
        "name": "CVE-2006-7196"
      },
      "impact_statement": "false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1358 is a false positive for org.apache.cxf:cxf-core 3.5.11-tuxcare.4. false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match.",
      "vulnerability": {
        "name": "CVE-2007-1358"
      },
      "impact_statement": "false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-2449 is a false positive for org.apache.cxf:cxf-core 3.5.11-tuxcare.4. false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match.",
      "vulnerability": {
        "name": "CVE-2007-2449"
      },
      "impact_statement": "false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2008-0128 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2008-0128"
      },
      "impact_statement": "not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2009-2696"
      },
      "impact_statement": "Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:cxf-core 3.5.11-tuxcare.4. false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository.",
      "vulnerability": {
        "name": "CVE-2010-1151"
      },
      "impact_statement": "false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2013-4286 is a false positive for org.apache.cxf:cxf-core 3.5.11-tuxcare.4. false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu...",
      "vulnerability": {
        "name": "CVE-2013-4286"
      },
      "impact_statement": "false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:cxf-core 3.5.11-tuxcare.4. false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com...",
      "vulnerability": {
        "name": "CVE-2013-6357"
      },
      "impact_statement": "false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:54:35.641153+00:00",
      "status_notes": "Vulnerability CVE-2014-0035 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0035 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability (UsernameToken transmitted in cleartext when EncryptedSupportingToken policy is set with EncryptBeforeSigning) was fixed by upstream Apache in May 2013 (commit 6358dc0577, CXF-5046) by Colm O Heigeartaigh. This fix was already present in the upstream release when TuxCare onboarded version 3.5.11. The current code co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0035"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0035 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability (UsernameToken transmitted in cleartext when EncryptedSupportingToken policy is set with EncryptBeforeSigning) was fixed by upstream Apache in May 2013 (commit 6358dc0577, CXF-5046) by Colm O Heigeartaigh. This fix was already present in the upstream release when TuxCare onboarded version 3.5.11. The current code co..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2014-0096"
      },
      "action_statement": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:55:16.058650+00:00",
      "status_notes": "Vulnerability CVE-2014-0109 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2014-0109 affects Apache CXF versions before 2.6.14 and 2.7.11. The target is version 3.5.11-tuxcare.10, which includes the upstream fix from February 2014. The vulnerability involved unbounded buffering of large requests with Content-Type: text/html sent to SOAP endpoints, causing memory exhaustion. The fix added two defenses: (1) restricting HTML error buffering to client-side only via Me...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0109"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0109 affects Apache CXF versions before 2.6.14 and 2.7.11. The target is version 3.5.11-tuxcare.10, which includes the upstream fix from February 2014. The vulnerability involved unbounded buffering of large requests with Content-Type: text/html sent to SOAP endpoints, causing memory exhaustion. The fix added two defenses: (1) restricting HTML error buffering to client-side only via Me..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:58:15.531409+00:00",
      "status_notes": "Vulnerability CVE-2014-0110 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 Apache CXF 3.5.11 is not affected by CVE-2014-0110. While the code allows unlimited disk consumption by default, the defense mechanism (ATTACHMENT_MAX_SIZE enforcement) is present and functional. This CVE affected versions before 2.6.14 and 2.7.x before 2.7.11; version 3.5.11 inherits the upstream fix. The defense requires configuration via the ATTACHMENT_MAX_SIZE property, which is the intende...",
      "vulnerability": {
        "name": "CVE-2014-0110"
      },
      "impact_statement": "not_affected \u2014 Apache CXF 3.5.11 is not affected by CVE-2014-0110. While the code allows unlimited disk consumption by default, the defense mechanism (ATTACHMENT_MAX_SIZE enforcement) is present and functional. This CVE affected versions before 2.6.14 and 2.7.x before 2.7.11; version 3.5.11 inherits the upstream fix. The defense requires configuration via the ATTACHMENT_MAX_SIZE property, which is the intende..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T03:53:30.805688+00:00",
      "status_notes": "Vulnerability CVE-2016-6812 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2016-6812 affects Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 due to XSS via unsanitized matrix parameters (semicolon-delimited URL path parameters) reflected in the HTML service list page. The target (Apache CXF 3.5.11-tuxcare.10) is NOT AFFECTED because the upstream fix authored by Sergey Beryozkin was already present in the Apache CXF 3.5.11 release. All three defense mechanisms ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6812"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6812 affects Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 due to XSS via unsanitized matrix parameters (semicolon-delimited URL path parameters) reflected in the HTML service list page. The target (Apache CXF 3.5.11-tuxcare.10) is NOT AFFECTED because the upstream fix authored by Sergey Beryozkin was already present in the Apache CXF 3.5.11 release. All three defense mechanisms ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2016-8739 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. CVE-2016-8739 affects Apache CXF's Atom JAX-RS MessageBodyReaders that directly parse XML without XXE protection. The vulnerability was fixed in upstream commit d9e2a6e726 (2016-11-23) by routing all Atom parsing through StaxUtils.createXMLStreamReader(), which provides comprehensive XXE defenses (disables DTD, entity references, external entities, and installs a blocking resolver). This fix was already present in the Apache CXF 3.5.11 release that TuxCare onboarded (5631 commits before first TuxCare commit b7acdd8c72). The target version 3.5.11-tuxcare.10 inherited this upstream fix. All Atom providers (AtomFeedProvider, AtomEntryProvider, AtomPojoProvider) use AbstractAtomProvider.readFrom() which contains the fix at lines 96-97. No vulnerable code pattern (direct InputStream parsing allowing XXE) exists in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.12; >= 3.1.0, < 3.1.9), NVD (<= 3.0.11; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8), cve.org (< 3.0.12; >= 3.1, < 3.1.9), Snyk (>= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8739"
      },
      "impact_statement": "CVE-2016-8739 affects Apache CXF's Atom JAX-RS MessageBodyReaders that directly parse XML without XXE protection. The vulnerability was fixed in upstream commit d9e2a6e726 (2016-11-23) by routing all Atom parsing through StaxUtils.createXMLStreamReader(), which provides comprehensive XXE defenses (disables DTD, entity references, external entities, and installs a blocking resolver). This fix was already present in the Apache CXF 3.5.11 release that TuxCare onboarded (5631 commits before first TuxCare commit b7acdd8c72). The target version 3.5.11-tuxcare.10 inherited this upstream fix. All Atom providers (AtomFeedProvider, AtomEntryProvider, AtomPojoProvider) use AbstractAtomProvider.readFrom() which contains the fix at lines 96-97. No vulnerable code pattern (direct InputStream parsing allowing XXE) exists in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.12; >= 3.1.0, < 3.1.9), NVD (<= 3.0.11; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8), cve.org (< 3.0.12; >= 3.1, < 3.1.9), Snyk (>= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T03:51:39.004857+00:00",
      "status_notes": "Vulnerability CVE-2017-12624 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2017-12624 fix is NOT VULNERABLE in target Apache CXF 3.5.11. The vulnerability (DoS via oversized attachment headers) was fixed by upstream Apache in commit 8bd915bfd7 (author: coheigea@apache.org, date: Oct 3, 2017, issue: CXF-7507). This fix was already present in the Apache CXF 3.5.11 upstream release before TuxCare onboarded the project (initial setup commit b7acdd8c72 by npinsker@clou...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12624"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-12624 fix is NOT VULNERABLE in target Apache CXF 3.5.11. The vulnerability (DoS via oversized attachment headers) was fixed by upstream Apache in commit 8bd915bfd7 (author: coheigea@apache.org, date: Oct 3, 2017, issue: CXF-7507). This fix was already present in the Apache CXF 3.5.11 upstream release before TuxCare onboarded the project (initial setup commit b7acdd8c72 by npinsker@clou..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T03:50:18.083941+00:00",
      "status_notes": "Vulnerability CVE-2017-5653 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2017-5653 is NOT present in Apache CXF 3.5.11. The vulnerability affected JAX-RS XML Security streaming clients that failed to validate whether service responses were signed or encrypted, allowing server spoofing. The fix (commit fade9b81da by Sergey Beryozkin) was applied by upstream Apache CXF in March 2017 for versions 3.1.11 and 3.0.13. This fix was already present in the upstream Apach...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5653"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-5653 is NOT present in Apache CXF 3.5.11. The vulnerability affected JAX-RS XML Security streaming clients that failed to validate whether service responses were signed or encrypted, allowing server spoofing. The fix (commit fade9b81da by Sergey Beryozkin) was applied by upstream Apache CXF in March 2017 for versions 3.1.11 and 3.0.13. This fix was already present in the upstream Apach..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-5656 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. The target Apache CXF 3.5.11-tuxcare.10 is NOT affected by CVE-2017-5656. The vulnerability concerns a flawed token ID extraction method in DefaultSTSTokenCacher that allowed attackers to craft tokens returning cached tokens for other users. The fix was applied upstream by Apache committer Colm O hEigeartaigh in commit 66c2c5b99e (April 2017) and was already present in Apache CXF 3.5.11 when TuxCare onboarded this version in December 2025. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.1.0, < 3.1.11; < 3.0.13), NVD (>= 3.0.0, < 3.0.13; >= 3.1.0, < 3.1.11), cve.org (>= 3.1, < 3.1.11; < 3.0.13), Snyk (< 3.0.14; >= 3.1.0, < 3.1.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5656"
      },
      "impact_statement": "The target Apache CXF 3.5.11-tuxcare.10 is NOT affected by CVE-2017-5656. The vulnerability concerns a flawed token ID extraction method in DefaultSTSTokenCacher that allowed attackers to craft tokens returning cached tokens for other users. The fix was applied upstream by Apache committer Colm O hEigeartaigh in commit 66c2c5b99e (April 2017) and was already present in Apache CXF 3.5.11 when TuxCare onboarded this version in December 2025. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.1.0, < 3.1.11; < 3.0.13), NVD (>= 3.0.0, < 3.0.13; >= 3.1.0, < 3.1.11), cve.org (>= 3.1, < 3.1.11; < 3.0.13), Snyk (< 3.0.14; >= 3.1.0, < 3.1.11)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:19.723998+00:00",
      "status_notes": "Vulnerability CVE-2022-46363 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. The target Apache CXF 3.5.11 is not affected by CVE-2022-46363. The vulnerability, which allowed remote directory listing or code exfiltration when both static-resources-list and redirect-query-check attributes were configured, was fixed in upstream Apache CXF versions 3.5.5 and 3.4.10. The fix (commit a1b5578cf9) was already present in the upstream 3.5.11 release that TuxCare onboarded. The fix prevents query strings from being included in static resource pattern matching by passing false to matchPath() for static resources while maintaining query string checking for redirects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0, < 3.5.5), NVD (< 3.4.10; >= 3.5.0, < 3.5.5), cve.org (>= 3.5, < 3.5.5; >= 3.4, < 3.4.10), Snyk (< 3.4.10; >= 3.5.0, < 3.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-46363"
      },
      "impact_statement": "The target Apache CXF 3.5.11 is not affected by CVE-2022-46363. The vulnerability, which allowed remote directory listing or code exfiltration when both static-resources-list and redirect-query-check attributes were configured, was fixed in upstream Apache CXF versions 3.5.5 and 3.4.10. The fix (commit a1b5578cf9) was already present in the upstream 3.5.11 release that TuxCare onboarded. The fix prevents query strings from being included in static resource pattern matching by passing false to matchPath() for static resources while maintaining query string checking for redirects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0, < 3.5.5), NVD (< 3.4.10; >= 3.5.0, < 3.5.5), cve.org (>= 3.5, < 3.5.5; >= 3.4, < 3.4.10), Snyk (< 3.4.10; >= 3.5.0, < 3.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:00:45.012229+00:00",
      "status_notes": "Vulnerability CVE-2022-46364 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. CVE-2022-46364 (SSRF via MTOM XOP:Include href parsing) is NOT present in Apache CXF 3.5.11. The vulnerability was fixed by upstream Apache CXF in commit bff4eb1959 (CXF-8706), which shipped in version 3.5.5 (released Nov 2022). The target version 3.5.11 already contains this upstream fix. The vulnerable pattern (unconditional URL dereferencing from XOP:Include href attributes) has been replaced with secure code that defaults to blocking URL access unless explicitly enabled via system property org.apache.cxf.attachment.xop.follow.urls=true. Both affected code locations (core AttachmentUtil and aegis databinding AttachmentUtil) have the fix applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0, < 3.5.5), NVD (< 3.4.10; >= 3.5.0, < 3.5.5), cve.org (< 3.5.5; < 3.4.10), Snyk (< 3.4.10; >= 3.5.0, < 3.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-46364"
      },
      "impact_statement": "CVE-2022-46364 (SSRF via MTOM XOP:Include href parsing) is NOT present in Apache CXF 3.5.11. The vulnerability was fixed by upstream Apache CXF in commit bff4eb1959 (CXF-8706), which shipped in version 3.5.5 (released Nov 2022). The target version 3.5.11 already contains this upstream fix. The vulnerable pattern (unconditional URL dereferencing from XOP:Include href attributes) has been replaced with secure code that defaults to blocking URL access unless explicitly enabled via system property org.apache.cxf.attachment.xop.follow.urls=true. Both affected code locations (core AttachmentUtil and aegis databinding AttachmentUtil) have the fix applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0, < 3.5.5), NVD (< 3.4.10; >= 3.5.0, < 3.5.5), cve.org (< 3.5.5; < 3.4.10), Snyk (< 3.4.10; >= 3.5.0, < 3.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:cxf-core 3.5.11-tuxcare.4. direct vulnerability is in Nu Html Checker (validator.nu) project",
      "vulnerability": {
        "name": "CVE-2025-15104"
      },
      "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T11:00:10.632468+00:00",
      "status_notes": "Vulnerability CVE-2025-23184 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 The target Apache CXF 3.5.11-tuxcare.10 is NOT AFFECTED by CVE-2025-23184. The vulnerability (CachedOutputStream instances not being closed, leading to temp file accumulation and filesystem exhaustion) was fixed in upstream Apache CXF 3.5.11 via commits 334ee45017 (CXF-7396) and d86bdbf915 (shutdown cleanup). Both fixes were authored by Andriy Redko (drreta@gmail.com) and shipped in the upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-23184"
      },
      "impact_statement": "not_affected \u2014 The target Apache CXF 3.5.11-tuxcare.10 is NOT AFFECTED by CVE-2025-23184. The vulnerability (CachedOutputStream instances not being closed, leading to temp file accumulation and filesystem exhaustion) was fixed in upstream Apache CXF 3.5.11 via commits 334ee45017 (CXF-7396) and d86bdbf915 (shutdown cleanup). Both fixes were authored by Andriy Redko (drreta@gmail.com) and shipped in the upstrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T10:55:02.016682+00:00",
      "status_notes": "Vulnerability CVE-2025-48795 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core. not_affected \u2014 CVE-2025-48795 does not affect this target. The vulnerability (logging entire CachedOutputStream objects causing OOM and unencrypted data exposure) was fixed in the upstream Apache CXF 3.5.11 release. The fix commit 8c0fcc5686, authored by MAUGIN Thomas, changed the logging statement from `next.closeable` to `next.closeable.hashCode()` to prevent materializing the entire temp file content into ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-48795"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-48795 does not affect this target. The vulnerability (logging entire CachedOutputStream objects causing OOM and unencrypted data exposure) was fixed in the upstream Apache CXF 3.5.11 release. The fix commit 8c0fcc5686, authored by MAUGIN Thomas, changed the logging statement from `next.closeable` to `next.closeable.hashCode()` to prevent materializing the entire temp file content into ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T10:35:00.151559+00:00",
      "status_notes": "Vulnerability CVE-2026-107937 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-107937"
      },
      "action_statement": "Vulnerability CVE-2026-107937 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T18:05:36.498239+00:00",
      "status_notes": "Vulnerability CVE-2026-108039 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-108039"
      },
      "action_statement": "Vulnerability CVE-2026-108039 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-49875 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-49875"
      },
      "action_statement": "Vulnerability CVE-2026-49875 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50645 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-50645"
      },
      "action_statement": "Vulnerability CVE-2026-50645 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-54225 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core.",
      "vulnerability": {
        "name": "CVE-2026-54225"
      },
      "action_statement": "Vulnerability CVE-2026-54225 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T18:05:36.498239+00:00",
      "status_notes": "Vulnerability CVE-2026-64958 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-64958"
      },
      "action_statement": "Vulnerability CVE-2026-64958 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-core@3.5.11-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T18:05:36.498239+00:00",
      "status_notes": "Vulnerability CVE-2026-78384 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-78384"
      },
      "action_statement": "Vulnerability CVE-2026-78384 affects version 3.5.11-tuxcare.4 of org.apache.cxf:cxf-core, and is fixed in 3.5.11-tuxcare.11."
    }
  ]
}