{
  "@id": "urn:uuid:6eb2926c-9917-4757-af94-20e6c14af46a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T23:42:00.124041+00:00",
      "status_notes": "Vulnerability CVE-2018-10862 does not affect version 19.0.1.Final-tuxcare.3 of org.wildfly.core:wildfly-server. not_affected \u2014 CVE-2018-10862 (Zip Slip) is NOT present in WildFly Core 19.0.1.Final. The upstream fix (commit 40996ae6d5 by Emmanuel Hugonnet, Red Hat) was applied before version 6.0.0.Alpha3 and shipped in the upstream release 19.0.1.Final that TuxCare onboarded. All production zip extraction code paths use path validation defenses: PathUtil.unzip() uses resolveSecurely() (line 325), ZipUtils.unzip() uses c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-10862"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-10862 (Zip Slip) is NOT present in WildFly Core 19.0.1.Final. The upstream fix (commit 40996ae6d5 by Emmanuel Hugonnet, Red Hat) was applied before version 6.0.0.Alpha3 and shipped in the upstream release 19.0.1.Final that TuxCare onboarded. All production zip extraction code paths use path validation defenses: PathUtil.unzip() uses resolveSecurely() (line 325), ZipUtils.unzip() uses c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2020-1719 is a false positive for org.wildfly.core:wildfly-server 19.0.1.Final-tuxcare.3. direct vulnerability is in WildFly project",
      "vulnerability": {
        "name": "CVE-2020-1719"
      },
      "impact_statement": "direct vulnerability is in WildFly project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T23:43:00.211995+00:00",
      "status_notes": "Vulnerability CVE-2021-3644 does not affect version 19.0.1.Final-tuxcare.3 of org.wildfly.core:wildfly-server. not_affected \u2014 The target repository (wildfly-core 19.0.1.Final-tuxcare.3) is not affected by CVE-2021-3644. The vulnerability allowed users to smuggle vault expressions within multi-expression attributes to bypass access controls by exploiting substring extraction logic that only examined the first expression. The upstream fix (commit d51afeb664 by darran.lofthouse@jboss.com, July 7, 2021) replaced the vulne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-3644"
      },
      "impact_statement": "not_affected \u2014 The target repository (wildfly-core 19.0.1.Final-tuxcare.3) is not affected by CVE-2021-3644. The vulnerability allowed users to smuggle vault expressions within multi-expression attributes to bypass access controls by exploiting substring extraction logic that only examined the first expression. The upstream fix (commit d51afeb664 by darran.lofthouse@jboss.com, July 7, 2021) replaced the vulne..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2022-0866 is a false positive for org.wildfly.core:wildfly-server 19.0.1.Final-tuxcare.3. direct vulnerability is in WildFly project",
      "vulnerability": {
        "name": "CVE-2022-0866"
      },
      "impact_statement": "direct vulnerability is in WildFly project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2022-1278 is a false positive for org.wildfly.core:wildfly-server 19.0.1.Final-tuxcare.3. direct vulnerability is in WildFly project",
      "vulnerability": {
        "name": "CVE-2022-1278"
      },
      "impact_statement": "direct vulnerability is in WildFly project"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-4029 affects version 19.0.1.Final-tuxcare.3 of org.wildfly.core:wildfly-server.",
      "vulnerability": {
        "name": "CVE-2024-4029"
      },
      "action_statement": "Vulnerability CVE-2024-4029 affects version 19.0.1.Final-tuxcare.3 of org.wildfly.core:wildfly-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.core/wildfly-server@19.0.1.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-23367 is fixed in version 19.0.1.Final-tuxcare.3 of org.wildfly.core:wildfly-server.",
      "vulnerability": {
        "name": "CVE-2025-23367"
      }
    }
  ]
}