{
  "@id": "urn:uuid:7e272f23-2700-4cc0-a7bd-0e61c92a6cc9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:00:45.012229+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.maven/maven-core@3.9.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.maven/maven-core@3.9.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:00:45.012229+00:00",
      "status_notes": "Vulnerability CVE-2021-26291 does not affect version 3.9.12-tuxcare.1 of org.apache.maven:maven-core. Apache Maven 3.9.12 is not affected by CVE-2021-26291. The vulnerability pattern (Maven following insecure HTTP repositories from dependency POMs) is not present because the fix was already included in the upstream release 3.9.12 that TuxCare onboarded. The defense mechanism is fully implemented and active: (1) code logic to detect external HTTP repositories via isExternalHttpRepo() in DefaultMirrorSelector.java:146-158 and MavenRepositorySystem.java, (2) EXTERNAL_HTTP_WILDCARD pattern matching for \"external:http:*\", (3) blocked mirror support in settings model, and (4) default maven-default-http-blocker configuration in settings.xml:160-166 that blocks all external HTTP repositories by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-26291"
      },
      "impact_statement": "Apache Maven 3.9.12 is not affected by CVE-2021-26291. The vulnerability pattern (Maven following insecure HTTP repositories from dependency POMs) is not present because the fix was already included in the upstream release 3.9.12 that TuxCare onboarded. The defense mechanism is fully implemented and active: (1) code logic to detect external HTTP repositories via isExternalHttpRepo() in DefaultMirrorSelector.java:146-158 and MavenRepositorySystem.java, (2) EXTERNAL_HTTP_WILDCARD pattern matching for \"external:http:*\", (3) blocked mirror support in settings model, and (4) default maven-default-http-blocker configuration in settings.xml:160-166 that blocks all external HTTP repositories by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.8.1; < 3.8.1), NVD (< 3.8.1), cve.org (<= 3.8.1), Snyk (< 3.8.1; < 3.8.1; < 3.8.1)."
    }
  ]
}