{
  "@id": "urn:uuid:4118ebf6-16ee-4d1f-993e-26b471dcadb5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T08:05:17.507303+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 is fixed in version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 does not affect version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. CVE-2023-26464 affects Apache Log4j 1.x with specific components (Chainsaw/SocketAppender) on JRE <1.7. This target is Log4j 2.6.2 which requires Java 7+. The CVE explicitly states it affects \"Apache Log4j before 2\" and recommends updating to Log4j 2.x as the fix. The vulnerable Log4j 1.x code patterns and components are not present in this Log4j 2.x codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "impact_statement": "CVE-2023-26464 affects Apache Log4j 1.x with specific components (Chainsaw/SocketAppender) on JRE <1.7. This target is Log4j 2.6.2 which requires Java 7+. The CVE explicitly states it affects \"Apache Log4j before 2\" and recommends updating to Log4j 2.x as the fix. The vulnerable Log4j 1.x code patterns and components are not present in this Log4j 2.x codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.4, < 2.0), NVD (>= 1.0.4, < 2.0), cve.org (>= 1.0.4, < 2; >= 1.0.4, < 2.0)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "action_statement": "Vulnerability CVE-2026-34477 affects version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 does not affect version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2026-34478 affects Log4j versions 2.21.0-2.25.3 due to configuration attribute renames introduced when Rfc5424Layout was migrated from factory method to builder pattern in 2.21.0. Target version 2.6.2 uses the original factory method pattern with documented attribute names (newLineEscape, useTlsMessageFormat) and never had the builder pattern or renamed attributes. The vulnerable code patte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-34478 affects Log4j versions 2.21.0-2.25.3 due to configuration attribute renames introduced when Rfc5424Layout was migrated from factory method to builder pattern in 2.21.0. Target version 2.6.2 uses the original factory method pattern with documented attribute names (newLineEscape, useTlsMessageFormat) and never had the builder pattern or renamed attributes. The vulnerable code patte..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 does not affect version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.6.2 is NOT AFFECTED by CVE-2026-34479. The vulnerable class `Log4j1XmlLayout` mentioned in the CVE does not exist in this version (it was introduced later in version 2.10.0). The only XML layout present in 2.6.2 is `XmlLayout`, which uses Jackson's `SanitizingXmlFactory` and was already protected by the CVE-2026-34480 backport (commit db02947e20) applied before the target release. Whi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34479"
      },
      "impact_statement": "not_affected \u2014 Version 2.6.2 is NOT AFFECTED by CVE-2026-34479. The vulnerable class `Log4j1XmlLayout` mentioned in the CVE does not exist in this version (it was introduced later in version 2.10.0). The only XML layout present in 2.6.2 is `XmlLayout`, which uses Jackson's `SanitizingXmlFactory` and was already protected by the CVE-2026-34480 backport (commit db02947e20) applied before the target release. Whi..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.6.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T08:05:17.507303+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 is fixed in version 2.6.2-tuxcare.2 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      }
    }
  ]
}