{
  "@id": "urn:uuid:e9dedd5f-8db9-4283-b6b8-fff372f3360a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-54225 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-54225"
      },
      "action_statement": "Vulnerability CVE-2026-54225 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-57817 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-57817"
      },
      "action_statement": "Vulnerability CVE-2026-57817 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-57818 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-57818"
      },
      "action_statement": "Vulnerability CVE-2026-57818 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-57819 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-57819"
      },
      "action_statement": "Vulnerability CVE-2026-57819 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-61466 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-61466"
      },
      "action_statement": "Vulnerability CVE-2026-61466 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-63687 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-63687"
      },
      "action_statement": "Vulnerability CVE-2026-63687 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-64958 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-64958"
      },
      "action_statement": "Vulnerability CVE-2026-64958 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65432 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-65432"
      },
      "action_statement": "Vulnerability CVE-2026-65432 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65583 does not affect version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs. not_affected \u2014 Apache CXF 3.4.5 contains the vulnerable code pattern (empty validateSelfIssuedProvider method), but the vulnerability is NOT exploitable in the default configuration. The supportSelfIssuedProvider flag defaults to false, causing self-issued OIDC tokens to be rejected by normal issuer validation logic. Exploitation requires explicit configuration via setSupportSelfIssuedProvider(true), which is...",
      "vulnerability": {
        "name": "CVE-2026-65583"
      },
      "impact_statement": "not_affected \u2014 Apache CXF 3.4.5 contains the vulnerable code pattern (empty validateSelfIssuedProvider method), but the vulnerability is NOT exploitable in the default configuration. The supportSelfIssuedProvider flag defaults to false, causing self-issued OIDC tokens to be rejected by normal issuer validation logic. Exploitation requires explicit configuration via setSupportSelfIssuedProvider(true), which is..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-66909 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-66909"
      },
      "action_statement": "Vulnerability CVE-2026-66909 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68079 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-68079"
      },
      "action_statement": "Vulnerability CVE-2026-68079 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf-rt-rs@3.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68481 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs.",
      "vulnerability": {
        "name": "CVE-2026-68481"
      },
      "action_statement": "Vulnerability CVE-2026-68481 affects version 3.4.5-tuxcare.1 of org.apache.cxf:cxf-rt-rs."
    }
  ]
}