{
  "@id": "urn:uuid:8d55d9eb-ee58-499c-85a2-1f92c87f3fc0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-22T18:31:25.360132+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:31:25.360132+00:00",
      "status_notes": "Vulnerability CVE-2026-0636 does not affect version 1.81.1-tuxcare.1 of org.bouncycastle:bcutil-jdk18on. not_affected \u2014 The target repository (BC-JAVA version 1.81.1) is NOT affected by CVE-2026-0636 (LDAP injection vulnerability). The upstream vendor fix that adds proper RFC2254 escaping via LDAPUtils.parseDN() was already present in the 1.81.1 release when TuxCare onboarded it. The vulnerable code pattern (parseDN returning unescaped DN attribute values) is not present in the shipped codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-0636"
      },
      "impact_statement": "not_affected \u2014 The target repository (BC-JAVA version 1.81.1) is NOT affected by CVE-2026-0636 (LDAP injection vulnerability). The upstream vendor fix that adds proper RFC2254 escaping via LDAPUtils.parseDN() was already present in the 1.81.1 release when TuxCare onboarded it. The vulnerable code pattern (parseDN returning unescaped DN attribute values) is not present in the shipped codebase."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:31:25.360132+00:00",
      "status_notes": "Vulnerability CVE-2026-13506 is fixed in version 1.81.1-tuxcare.1 of org.bouncycastle:bcutil-jdk18on.",
      "vulnerability": {
        "name": "CVE-2026-13506"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:31:25.360132+00:00",
      "status_notes": "Vulnerability CVE-2026-3505 affects version 1.81.1-tuxcare.1 of org.bouncycastle:bcutil-jdk18on.",
      "vulnerability": {
        "name": "CVE-2026-3505"
      },
      "action_statement": "Vulnerability CVE-2026-3505 affects version 1.81.1-tuxcare.1 of org.bouncycastle:bcutil-jdk18on."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:31:25.360132+00:00",
      "status_notes": "Vulnerability CVE-2026-5588 affects version 1.81.1-tuxcare.1 of org.bouncycastle:bcutil-jdk18on.",
      "vulnerability": {
        "name": "CVE-2026-5588"
      },
      "action_statement": "Vulnerability CVE-2026-5588 affects version 1.81.1-tuxcare.1 of org.bouncycastle:bcutil-jdk18on."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.81.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T18:31:25.360132+00:00",
      "status_notes": "Vulnerability CVE-2026-8763 affects version 1.81.1-tuxcare.1 of org.bouncycastle:bcutil-jdk18on.",
      "vulnerability": {
        "name": "CVE-2026-8763"
      },
      "action_statement": "Vulnerability CVE-2026-8763 affects version 1.81.1-tuxcare.1 of org.bouncycastle:bcutil-jdk18on."
    }
  ]
}