{
  "@id": "urn:uuid:443472b6-a558-4011-8f47-e8b6e892fd2e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T11:58:00.148214+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.8.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.8.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:58:00.148214+00:00",
      "status_notes": "Vulnerability CVE-2026-49844 does not affect version 2.8.2-tuxcare.1 of org.apache.logging.log4j:log4j-slf4j-impl. not_affected \u2014 Target version 2.8.2 is NOT affected by CVE-2026-49844. The vulnerable code component (MapMessageJsonFormatter.java with unquoted non-finite numeric serialization) does not exist in this version. The target's MapMessage.asJson() implementation uses StringBuilders.appendDqValue() which always wraps ALL values in double quotes, making it architecturally impossible to produce malformed JSON output...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "impact_statement": "not_affected \u2014 Target version 2.8.2 is NOT affected by CVE-2026-49844. The vulnerable code component (MapMessageJsonFormatter.java with unquoted non-finite numeric serialization) does not exist in this version. The target's MapMessage.asJson() implementation uses StringBuilders.appendDqValue() which always wraps ALL values in double quotes, making it architecturally impossible to produce malformed JSON output..."
    }
  ]
}