{
  "@id": "urn:uuid:05cd9168-6492-40e0-a859-78070744f8ac",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T15:43:25.783855+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.maven/maven-compat@3.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.maven/maven-compat@3.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T15:43:25.783855+00:00",
      "status_notes": "Vulnerability CVE-2021-26291 does not affect version 3.8.7-tuxcare.1 of org.apache.maven:maven-compat. The target (Apache Maven 3.8.7) is not affected by CVE-2021-26291. The vulnerability affects Maven versions prior to 3.8.1, where Maven would follow HTTP repository references defined in dependency POMs, potentially allowing attackers to serve malicious artifacts. The fix, which blocks external HTTP repositories by default, was authored by the Apache Maven team (commit 907d53ad32 by hboutemy@apache.org) and shipped in the upstream Maven 3.8.1 release. Since the target is version 3.8.7, it already contains this fix from the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-26291"
      },
      "impact_statement": "The target (Apache Maven 3.8.7) is not affected by CVE-2021-26291. The vulnerability affects Maven versions prior to 3.8.1, where Maven would follow HTTP repository references defined in dependency POMs, potentially allowing attackers to serve malicious artifacts. The fix, which blocks external HTTP repositories by default, was authored by the Apache Maven team (commit 907d53ad32 by hboutemy@apache.org) and shipped in the upstream Maven 3.8.1 release. Since the target is version 3.8.7, it already contains this fix from the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1)."
    }
  ]
}