{ "@id": "urn:uuid:a29def9c-e96c-48a2-aeae-592823bbee3e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:03:00.104314+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:13:29.842653+00:00", "status_notes": "Vulnerability CVE-2017-5645 does not affect version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. Target version 2.11.0 is not affected by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer and UdpSocketServer) that accepted serialized log events over network connections were completely removed from the main Log4j repository in version 2.10.0 (commit 8865124fb1, April 2017). These components were moved to a separate Tools repository. Version 2.11.0 does not contain any network server code that receives and deserializes data, making the attack vector impossible. The upstream fix (FilteredObjectInputStream) was applied in version 2.8.2 (commit 5dcc192158, March 2017) before the components were removed, but the complete removal provides even stronger protection. The fix was authored by upstream (Matt Sicker, boards@gmail.com) and shipped in the upstream release before TuxCare started maintaining this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5645" }, "impact_statement": "Target version 2.11.0 is not affected by CVE-2017-5645. The vulnerable socket server components (TcpSocketServer and UdpSocketServer) that accepted serialized log events over network connections were completely removed from the main Log4j repository in version 2.10.0 (commit 8865124fb1, April 2017). These components were moved to a separate Tools repository. Version 2.11.0 does not contain any network server code that receives and deserializes data, making the attack vector impossible. The upstream fix (FilteredObjectInputStream) was applied in version 2.8.2 (commit 5dcc192158, March 2017) before the components were removed, but the complete removal provides even stronger protection. The fix was authored by upstream (Matt Sicker, boards@gmail.com) and shipped in the upstream release before TuxCare started maintaining this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.8.2; >= 2.0, < 2.8.2), NVD (>= 2.0, < 2.8.2), cve.org (= 2.0-alpha1; = 2.8.1), Snyk (>= 2.0, < 2.8.2; < 2.8.2)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-9488 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2020-9488" }, "action_statement": "Vulnerability CVE-2020-9488 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-09-28T18:35:38.282754+00:00", "status_notes": "Vulnerability CVE-2021-44228 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.11.0-tuxcare.2.", "vulnerability": { "name": "CVE-2021-44228" }, "action_statement": "Vulnerability CVE-2021-44228 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.11.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-44832 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2021-44832" }, "action_statement": "Vulnerability CVE-2021-44832 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-09-28T18:35:38.282754+00:00", "status_notes": "Vulnerability CVE-2021-45046 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.11.0-tuxcare.2.", "vulnerability": { "name": "CVE-2021-45046" }, "action_statement": "Vulnerability CVE-2021-45046 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.11.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45105 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2021-45105" }, "action_statement": "Vulnerability CVE-2021-45105 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Log4j 1.x components (Chainsaw and SocketAppender) that deserialize deeply nested hashmaps/hashtables without depth limits, causing memory exhaustion. This repository is Apache Log4j 2 (version 2.11.0), which is a complete rewrite of Log4j 1.x and the recommended fix for all Log4j 1.x vulnerabilities. The vulnerable components do not exist in Log4j 2: (1) No Chainsaw component is present (only documentation about Chainsaw support for log file advertising); (2) No Log4j 1.x SocketAppender exists - Log4j 2 has a completely rewritten SocketAppender using modern plugin architecture; (3) The log4j-1.2-api module is only a compatibility facade that provides Log4j 1.x API compatibility by delegating to Log4j 2's safe internals. The vulnerable deserialization code path from Log4j 1.x is not present in this codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26464" }, "impact_statement": "CVE-2023-26464 affects Log4j 1.x components (Chainsaw and SocketAppender) that deserialize deeply nested hashmaps/hashtables without depth limits, causing memory exhaustion. This repository is Apache Log4j 2 (version 2.11.0), which is a complete rewrite of Log4j 1.x and the recommended fix for all Log4j 1.x vulnerabilities. The vulnerable components do not exist in Log4j 2: (1) No Chainsaw component is present (only documentation about Chainsaw support for log file advertising); (2) No Log4j 1.x SocketAppender exists - Log4j 2 has a completely rewritten SocketAppender using modern plugin architecture; (3) The log4j-1.2-api module is only a compatibility facade that provides Log4j 1.x API compatibility by delegating to Log4j 2's safe internals. The vulnerable deserialization code path from Log4j 1.x is not present in this codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68161 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2025-68161" }, "action_statement": "Vulnerability CVE-2025-68161 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-10-31T12:39:49.970818+00:00", "status_notes": "Vulnerability CVE-2026-34477 does not affect version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.11.0 is not affected by CVE-2026-34477. This CVE specifically addresses a bug where the `verifyHostName` XML configuration attribute (introduced in Log4j 2.12.0) was silently ignored in versions 2.12.0-2.25.3 due to incorrect @PluginFactory annotation placement. Since version 2.11.0 predates the introduction of this attribute, the specific vulnerability pattern (attribute being ignore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34477" }, "impact_statement": "not_affected \u2014 Version 2.11.0 is not affected by CVE-2026-34477. This CVE specifically addresses a bug where the `verifyHostName` XML configuration attribute (introduced in Log4j 2.12.0) was silently ignored in versions 2.12.0-2.25.3 due to incorrect @PluginFactory annotation placement. Since version 2.11.0 predates the introduction of this attribute, the specific vulnerability pattern (attribute being ignore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-11-01T08:02:00.201586+00:00", "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.11.0 is not affected by CVE-2026-34478. This version uses the legacy @PluginFactory pattern for Rfc5424Layout configuration, which predates the vulnerable @PluginBuilderFactory pattern introduced in version 2.21.0. The documented attribute names (newLineEscape, useTlsMessageFormat, mdcExcludes, mdcIncludes, mdcRequired) work correctly in the factory method pattern and are not silently...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34478" }, "impact_statement": "not_affected \u2014 Version 2.11.0 is not affected by CVE-2026-34478. This version uses the legacy @PluginFactory pattern for Rfc5424Layout configuration, which predates the vulnerable @PluginBuilderFactory pattern introduced in version 2.21.0. The documented attribute names (newLineEscape, useTlsMessageFormat, mdcExcludes, mdcIncludes, mdcRequired) work correctly in the factory method pattern and are not silently..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34479 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core.", "vulnerability": { "name": "CVE-2026-34479" }, "action_statement": "Vulnerability CVE-2026-34479 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.11.0-tuxcare.1" } } ], "timestamp": "2026-09-28T18:35:38.282754+00:00", "status_notes": "Vulnerability CVE-2026-34480 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.11.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-34480" }, "action_statement": "Vulnerability CVE-2026-34480 affects version 2.11.0-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.11.0-tuxcare.2." } ] }