{
  "@id": "urn:uuid:1e400ab0-72ab-4999-957b-dd99e44a5bf3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:06:46.571739+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.maven/maven-core@3.9.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.maven/maven-core@3.9.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:46.571739+00:00",
      "status_notes": "Vulnerability CVE-2021-26291 does not affect version 3.9.11-tuxcare.1 of org.apache.maven:maven-core. CVE-2021-26291 affects Apache Maven versions prior to 3.8.1, which did not block HTTP (non-SSL) repositories by default, allowing potential man-in-the-middle attacks. The target repository is Maven 3.9.11, which already contains the upstream fix introduced in Maven 3.8.1 (March 2021). The fix includes: (1) a default blocked mirror configuration for external:http:* repositories in settings.xml, (2) the isExternalHttpRepo() method to identify HTTP repositories, and (3) support for the \"blocked\" mirror attribute. All these components are present and functional in the target. The fix was authored by Apache committer Herv\u00e9 Boutemy and shipped in the upstream Maven 3.9.11 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-26291"
      },
      "impact_statement": "CVE-2021-26291 affects Apache Maven versions prior to 3.8.1, which did not block HTTP (non-SSL) repositories by default, allowing potential man-in-the-middle attacks. The target repository is Maven 3.9.11, which already contains the upstream fix introduced in Maven 3.8.1 (March 2021). The fix includes: (1) a default blocked mirror configuration for external:http:* repositories in settings.xml, (2) the isExternalHttpRepo() method to identify HTTP repositories, and (3) support for the \"blocked\" mirror attribute. All these components are present and functional in the target. The fix was authored by Apache committer Herv\u00e9 Boutemy and shipped in the upstream Maven 3.9.11 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1)."
    }
  ]
}