{
  "@id": "urn:uuid:a65c7073-617f-4cba-98dc-483a4090c0ca",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-27T16:43:34.625399+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.micrometer/micrometer-jetty11@1.11.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.micrometer/micrometer-jetty11@1.11.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T16:43:07.026677+00:00",
      "status_notes": "Vulnerability CVE-2026-40983 does not affect version 1.11.8-tuxcare.1 of io.micrometer:micrometer-jetty11. CVE-2026-40983 is caused by DefaultGrpcServerObservationConvention emitting gRPC peer name/port as low-cardinality key values (unbounded metric dimensions). This was introduced in Micrometer 1.15.0 and fixed by upstream commit dc2e5e2e, which moved them to high-cardinality. In tuxcare-current/1.11.8, getLowCardinalityKeyValues emits only method, service, method_type and status_code. GrpcObservationDocumentation.LowCardinalityKeyNames has no PEER_NAME/PEER_PORT, and GrpcServerObservationContext has no peer fields (a branch search for PEER_NAME returns 0 hits). The file is unchanged since the upstream 2022 commit 036b40e4, so the vulnerable code was never present. This matches the advisory (\u201cOlder versions than 1.15.0 are not affected\u201d) and siblings 1.10.13/1.12.12/1.13.15/1.14.x (not_affected/code_not_present).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40983"
      },
      "impact_statement": "CVE-2026-40983 is caused by DefaultGrpcServerObservationConvention emitting gRPC peer name/port as low-cardinality key values (unbounded metric dimensions). This was introduced in Micrometer 1.15.0 and fixed by upstream commit dc2e5e2e, which moved them to high-cardinality. In tuxcare-current/1.11.8, getLowCardinalityKeyValues emits only method, service, method_type and status_code. GrpcObservationDocumentation.LowCardinalityKeyNames has no PEER_NAME/PEER_PORT, and GrpcServerObservationContext has no peer fields (a branch search for PEER_NAME returns 0 hits). The file is unchanged since the upstream 2022 commit 036b40e4, so the vulnerable code was never present. This matches the advisory (\u201cOlder versions than 1.15.0 are not affected\u201d) and siblings 1.10.13/1.12.12/1.13.15/1.14.x (not_affected/code_not_present)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.micrometer/micrometer-jetty11@1.11.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.micrometer/micrometer-jetty11@1.11.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T16:43:07.026677+00:00",
      "status_notes": "Vulnerability CVE-2026-40984 affects version 1.11.8-tuxcare.1 of io.micrometer:micrometer-jetty11.",
      "vulnerability": {
        "name": "CVE-2026-40984"
      },
      "action_statement": "Vulnerability CVE-2026-40984 affects version 1.11.8-tuxcare.1 of io.micrometer:micrometer-jetty11."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.micrometer/micrometer-jetty11@1.11.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.micrometer/micrometer-jetty11@1.11.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T16:43:34.625399+00:00",
      "status_notes": "Vulnerability CVE-2026-59295 is fixed in version 1.11.8-tuxcare.1 of io.micrometer:micrometer-jetty11.",
      "vulnerability": {
        "name": "CVE-2026-59295"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.micrometer/micrometer-jetty11@1.11.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.micrometer/micrometer-jetty11@1.11.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T16:43:34.625399+00:00",
      "status_notes": "Vulnerability CVE-2026-59296 is fixed in version 1.11.8-tuxcare.1 of io.micrometer:micrometer-jetty11.",
      "vulnerability": {
        "name": "CVE-2026-59296"
      }
    }
  ]
}