{
  "@id": "urn:uuid:8e3f992b-b018-40a1-8c49-064a417a72fc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T17:45:29.746671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.maven/maven-core@3.8.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.maven/maven-core@3.8.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:45:29.746671+00:00",
      "status_notes": "Vulnerability CVE-2021-26291 does not affect version 3.8.4-tuxcare.2 of org.apache.maven:maven-core. Maven 3.8.4-tuxcare.1 is not affected by CVE-2021-26291. The fix for blocking external HTTP repositories was already included in the upstream Apache Maven 3.8.4 release. The vulnerability protection consists of: (1) isExternalHttpRepo() method that detects external HTTP/DAV repositories, (2) support for blocked mirror attribute, and (3) default mirror configuration that blocks all external HTTP repositories. All three fix commits (fa79cb22, 907d53ad, 899465ae) authored by Herv\u00e9 Boutemy were merged before Maven 3.8.1 release (March 2021) and are ancestors of the onboarding commit that brought Maven 3.8.4 into the TuxCare repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-26291"
      },
      "impact_statement": "Maven 3.8.4-tuxcare.1 is not affected by CVE-2021-26291. The fix for blocking external HTTP repositories was already included in the upstream Apache Maven 3.8.4 release. The vulnerability protection consists of: (1) isExternalHttpRepo() method that detects external HTTP/DAV repositories, (2) support for blocked mirror attribute, and (3) default mirror configuration that blocks all external HTTP repositories. All three fix commits (fa79cb22, 907d53ad, 899465ae) authored by Herv\u00e9 Boutemy were merged before Maven 3.8.1 release (March 2021) and are ancestors of the onboarding commit that brought Maven 3.8.4 into the TuxCare repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1)."
    }
  ]
}