{
  "@id": "urn:uuid:c8aeb8ad-b90f-4208-8335-a1996cde711c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T12:56:47.729906+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5645 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2017-5645"
      },
      "action_statement": "Vulnerability CVE-2017-5645 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-9488 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2020-9488"
      },
      "action_statement": "Vulnerability CVE-2020-9488 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2021-44228 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-44228"
      },
      "action_statement": "Vulnerability CVE-2021-44228 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.5-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-44832 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-44832"
      },
      "action_statement": "Vulnerability CVE-2021-44832 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2021-45046 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-45046"
      },
      "action_statement": "Vulnerability CVE-2021-45046 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.5-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-45105 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2021-45105"
      },
      "action_statement": "Vulnerability CVE-2021-45105 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T18:26:13.115250+00:00",
      "status_notes": "Vulnerability CVE-2023-26464 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2023-26464"
      },
      "action_statement": "Vulnerability CVE-2023-26464 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-68161 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "action_statement": "Vulnerability CVE-2025-68161 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2026-34477 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "action_statement": "Vulnerability CVE-2026-34477 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2026-34478 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core.",
      "vulnerability": {
        "name": "CVE-2026-34478"
      },
      "action_statement": "Vulnerability CVE-2026-34478 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:56:47.729906+00:00",
      "status_notes": "Vulnerability CVE-2026-34479 does not affect version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 CVE-2026-34479 affects Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge. This component was introduced in Log4j version 2.7 (commit 8e01bde35d on 2016-08-14) and does not exist in the target version 2.5. The target repository is Apache Log4j 2 (correct product), but the specific vulnerable component Log4j1XmlLayout was not yet introduced at this version. While the Transform.java utilit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-34479"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-34479 affects Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge. This component was introduced in Log4j version 2.7 (commit 8e01bde35d on 2016-08-14) and does not exist in the target version 2.5. The target repository is Apache Log4j 2 (correct product), but the specific vulnerable component Log4j1XmlLayout was not yet introduced at this version. While the Transform.java utilit..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-29T09:02:14.420070+00:00",
      "status_notes": "Vulnerability CVE-2026-34480 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "action_statement": "Vulnerability CVE-2026-34480 affects version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core, and is fixed in 2.5-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:53:00.170447+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 does not affect version 2.5-tuxcare.1 of org.apache.logging.log4j:log4j-core. not_affected \u2014 Version 2.5 is not affected by CVE-2026-49844. The vulnerability concerns improper JSON encoding of non-finite floating-point values (NaN, Infinity, -Infinity) in MapMessage, but version 2.5's MapMessage only supports String values and cannot hold floating-point types. The vulnerable code path (MapMessageJsonFormatter handling numeric types) doesn't exist in this version. The CVE's affected ran...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "impact_statement": "not_affected \u2014 Version 2.5 is not affected by CVE-2026-49844. The vulnerability concerns improper JSON encoding of non-finite floating-point values (NaN, Infinity, -Infinity) in MapMessage, but version 2.5's MapMessage only supports String values and cannot hold floating-point types. The vulnerable code path (MapMessageJsonFormatter handling numeric types) doesn't exist in this version. The CVE's affected ran..."
    }
  ]
}