{
  "@id": "urn:uuid:de58a400-e451-4104-9f43-d79e58abe0b1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:47:00.030022+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40opentelemetry/core@2.11.0",
          "identifiers": {
            "purl": "pkg:npm/%40opentelemetry/core@2.11.0"
          }
        }
      ],
      "timestamp": "2026-11-06T11:47:00.030022+00:00",
      "status_notes": "Vulnerability CVE-2026-54285 does not affect version 2.11.0 of @opentelemetry/core. not_affected \u2014 The target (@opentelemetry/core 2.11.0) already enforces the W3C baggage limits on the inbound extract() path. Parsing stops at 180 entries, skips entries over 4096 bytes, and stops once the total reaches 8192 bytes. The fix came from an upstream commit by Dynatrace (4b13587d1, 'Merge commit from fork'), and the only later commits are automated tuxcare.yaml additions, so this is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54285"
      },
      "impact_statement": "not_affected \u2014 The target (@opentelemetry/core 2.11.0) already enforces the W3C baggage limits on the inbound extract() path. Parsing stops at 180 entries, skips entries over 4096 bytes, and stops once the total reaches 8192 bytes. The fix came from an upstream commit by Dynatrace (4b13587d1, 'Merge commit from fork'), and the only later commits are automated tuxcare.yaml additions, so this is an upstream fix."
    }
  ]
}