{
  "@id": "urn:uuid:5167d642-8902-4e97-8eb5-19face96902e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1327 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent.",
      "vulnerability": {
        "name": "CVE-2018-1327"
      },
      "action_statement": "Vulnerability CVE-2018-1327 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T18:59:00.218537+00:00",
      "status_notes": "Vulnerability CVE-2026-104711 does not affect version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent. not_affected \u2014 Apache Struts 2.5.33 contains the vulnerable RestfulActionMapper code that allows OGNL expression injection leading to RCE, but this component is NOT active in the default configuration. The framework ships with DefaultActionMapper as the default action mapper (struts-default.xml:112), which is not vulnerable. The legacy RestfulActionMapper is only exposed if an application explicitly configure...",
      "vulnerability": {
        "name": "CVE-2026-104711"
      },
      "impact_statement": "not_affected \u2014 Apache Struts 2.5.33 contains the vulnerable RestfulActionMapper code that allows OGNL expression injection leading to RCE, but this component is NOT active in the default configuration. The framework ships with DefaultActionMapper as the default action mapper (struts-default.xml:112), which is not vulnerable. The legacy RestfulActionMapper is only exposed if an application explicitly configure..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T18:50:15.032819+00:00",
      "status_notes": "Vulnerability CVE-2026-104712 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent.",
      "vulnerability": {
        "name": "CVE-2026-104712"
      },
      "action_statement": "Vulnerability CVE-2026-104712 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T18:51:00.139198+00:00",
      "status_notes": "Vulnerability CVE-2026-104713 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent.",
      "vulnerability": {
        "name": "CVE-2026-104713"
      },
      "action_statement": "Vulnerability CVE-2026-104713 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-05T18:51:00.139198+00:00",
      "status_notes": "Vulnerability CVE-2026-104714 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent.",
      "vulnerability": {
        "name": "CVE-2026-104714"
      },
      "action_statement": "Vulnerability CVE-2026-104714 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-parent@2.5.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-73633 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent.",
      "vulnerability": {
        "name": "CVE-2026-73633"
      },
      "action_statement": "Vulnerability CVE-2026-73633 affects version 2.5.33-tuxcare.1 of org.apache.struts:struts2-parent."
    }
  ]
}