{
  "@id": "urn:uuid:1939ef4d-98a5-40b5-8fe5-a510b11c9120",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T15:11:10.267577+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:23.982187+00:00",
      "status_notes": "Vulnerability CVE-2017-14063 does not affect version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client. The target repository (async-http-client 2.12.3-tuxcare.1) is NOT affected by CVE-2017-14063. The vulnerability, which allowed URL parsing confusion when a '?' character appears in a fragment identifier, was fixed in the upstream release before TuxCare onboarded version 2.12.3. The fix commit (eb9e3347e) authored by Stephane Landelle (slandelle@gatling.io) is present in HEAD and was part of the upstream release 2.12.3 that TuxCare onboarded. The vulnerable code pattern (parsing query before trimming fragment) is not present; the current code correctly trims the fragment before searching for the query delimiter.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.35), NVD (< 2.0.35), Snyk (< 2.0.35; < 2.0.35).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14063"
      },
      "impact_statement": "The target repository (async-http-client 2.12.3-tuxcare.1) is NOT affected by CVE-2017-14063. The vulnerability, which allowed URL parsing confusion when a '?' character appears in a fragment identifier, was fixed in the upstream release before TuxCare onboarded version 2.12.3. The fix commit (eb9e3347e) authored by Stephane Landelle (slandelle@gatling.io) is present in HEAD and was part of the upstream release 2.12.3 that TuxCare onboarded. The vulnerable code pattern (parsing query before trimming fragment) is not present; the current code correctly trims the fragment before searching for the query delimiter.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.35), NVD (< 2.0.35), Snyk (< 2.0.35; < 2.0.35)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:45.109929+00:00",
      "status_notes": "Vulnerability CVE-2024-53990 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2024-53990"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107226 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107226"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107227 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107227"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107228 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107228"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107230 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107230"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107231 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107231"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107280 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107280"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107282 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107282"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107283 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107283"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-107285 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-107285"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:59.002028+00:00",
      "status_notes": "Vulnerability CVE-2026-40490 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-40490"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:59.002028+00:00",
      "status_notes": "Vulnerability CVE-2026-45300 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-45300"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:59.002028+00:00",
      "status_notes": "Vulnerability CVE-2026-55688 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-55688"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:23.982187+00:00",
      "status_notes": "Vulnerability CVE-2026-85716 does not affect version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client. not_affected \u2014 Target version 2.12.3 is NOT affected by CVE-2026-85716. The CVE explicitly excludes the 2.x line, stating \"The 2.x line is not affected either: it has no SCRAM support, and its interceptor chain does not implement Digest mutual authentication, so there is no verification result to act on.\" Code inspection confirms: (1) No SCRAM support - Realm.AuthScheme enum contains only BASIC, DIGEST, NTLM,...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-85716"
      },
      "impact_statement": "not_affected \u2014 Target version 2.12.3 is NOT affected by CVE-2026-85716. The CVE explicitly excludes the 2.x line, stating \"The 2.x line is not affected either: it has no SCRAM support, and its interceptor chain does not implement Digest mutual authentication, so there is no verification result to act on.\" Code inspection confirms: (1) No SCRAM support - Realm.AuthScheme enum contains only BASIC, DIGEST, NTLM,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:23.982187+00:00",
      "status_notes": "Vulnerability CVE-2026-85717 does not affect version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client. not_affected \u2014 Version 2.12.3 is NOT affected by CVE-2026-85717. This CVE describes a RESIDUAL vulnerability that bypasses the cross-origin credential strip introduced by GHSA-cmxv-58fp-fm3g. Version 2.12.3 predates that strip mechanism (affected versions: 2.14.5-2.16.0), so the specific bypass chain this CVE addresses cannot occur. The CVE explicitly states: \"Releases below those floors are covered by the ea...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-85717"
      },
      "impact_statement": "not_affected \u2014 Version 2.12.3 is NOT affected by CVE-2026-85717. This CVE describes a RESIDUAL vulnerability that bypasses the cross-origin credential strip introduced by GHSA-cmxv-58fp-fm3g. Version 2.12.3 predates that strip mechanism (affected versions: 2.14.5-2.16.0), so the specific bypass chain this CVE addresses cannot occur. The CVE explicitly states: \"Releases below those floors are covered by the ea..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:11:10.267577+00:00",
      "status_notes": "Vulnerability CVE-2026-85720 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-85720"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:59.002028+00:00",
      "status_notes": "Vulnerability CVE-2026-85721 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "CVE-2026-85721"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:10:45.109929+00:00",
      "status_notes": "Vulnerability GHSA-cmxv-58fp-fm3g is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client.",
      "vulnerability": {
        "name": "GHSA-cmxv-58fp-fm3g"
      }
    }
  ]
}