{
  "@id": "urn:uuid:4ae6d2a1-15e4-4b78-91c6-c4c07aeeef97",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-09-24T09:31:26.931840+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22160 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. Wrong-project match. CVE-2021-22160 concerns Apache Pulsar SERVER's JWT authentication validation (broker component), while this repository is pulsar-client-reactive 0.5.10, a reactive CLIENT library that connects TO Pulsar servers. The vulnerable server-side JWT validation code is completely absent from this client-only repository.",
      "vulnerability": {
        "name": "CVE-2021-22160"
      },
      "impact_statement": "Wrong-project match. CVE-2021-22160 concerns Apache Pulsar SERVER's JWT authentication validation (broker component), while this repository is pulsar-client-reactive 0.5.10, a reactive CLIENT library that connects TO Pulsar servers. The vulnerable server-side JWT validation code is completely absent from this client-only repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-24280 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-24280 targets the Apache Pulsar Proxy server component, but the target repository (pulsar-client-reactive v0.5.10) is a client library. The provided patch only upgrades dependency versions in build configuration files. Exhaustive searches found zero proxy-related code in the target repository - no proxy classes, packages (org.apache.pulsar.proxy), or server components. The repository o...",
      "vulnerability": {
        "name": "CVE-2022-24280"
      },
      "impact_statement": "false_positive \u2014 CVE-2022-24280 targets the Apache Pulsar Proxy server component, but the target repository (pulsar-client-reactive v0.5.10) is a client library. The provided patch only upgrades dependency versions in build configuration files. Exhaustive searches found zero proxy-related code in the target repository - no proxy classes, packages (org.apache.pulsar.proxy), or server components. The repository o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-33681 does not affect version 0.5.10-tuxcare.1 of org.apache.pulsar:pulsar-client-reactive-jackson. not_affected \u2014 The target repository (apache/pulsar-client-reactive v0.5.10) is NOT AFFECTED by CVE-2022-33681. This is a reactive wrapper library that does not contain the vulnerable TLS hostname verification code. The vulnerability exists only in the underlying Apache Pulsar client dependency (org.apache.pulsar:pulsar-client), and the target depends on version 3.3.3, which is well beyond the vulnerable vers...",
      "vulnerability": {
        "name": "CVE-2022-33681"
      },
      "impact_statement": "not_affected \u2014 The target repository (apache/pulsar-client-reactive v0.5.10) is NOT AFFECTED by CVE-2022-33681. This is a reactive wrapper library that does not contain the vulnerable TLS hostname verification code. The vulnerability exists only in the underlying Apache Pulsar client dependency (org.apache.pulsar:pulsar-client), and the target depends on version 3.3.3, which is well beyond the vulnerable vers..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-33682 does not affect version 0.5.10-tuxcare.1 of org.apache.pulsar:pulsar-client-reactive-jackson. not_affected \u2014 CVE-2022-33682 affects TLS hostname verification in Apache Pulsar Java client versions \u22642.10.0, fixed in 2.10.2+. The target repository (pulsar-client-reactive v0.5.10) is a reactive wrapper that delegates all TLS/connection handling to the underlying Pulsar Java client library. The target depends on Pulsar 3.3.3 (gradle/libs.versions.toml:32), which is well beyond the fixed version. The vulner...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-33682"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-33682 affects TLS hostname verification in Apache Pulsar Java client versions \u22642.10.0, fixed in 2.10.2+. The target repository (pulsar-client-reactive v0.5.10) is a reactive wrapper that delegates all TLS/connection handling to the underlying Pulsar Java client library. The target depends on Pulsar 3.3.3 (gradle/libs.versions.toml:32), which is well beyond the fixed version. The vulner..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-33683 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-33683 affects Apache Pulsar Broker and Proxy server components, specifically how they initialize their internal Admin Client with insecure TLS configuration. The target repository (pulsar-client-reactive v0.5.10) is a CLIENT library wrapper for reactive programming that contains ZERO Broker, Proxy, or Admin Client code. This is a wrong-project match: the CVE targets server-side compone...",
      "vulnerability": {
        "name": "CVE-2022-33683"
      },
      "impact_statement": "false_positive \u2014 CVE-2022-33683 affects Apache Pulsar Broker and Proxy server components, specifically how they initialize their internal Admin Client with insecure TLS configuration. The target repository (pulsar-client-reactive v0.5.10) is a CLIENT library wrapper for reactive programming that contains ZERO Broker, Proxy, or Admin Client code. This is a wrong-project match: the CVE targets server-side compone..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-33684 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-33684 is in the Apache Pulsar C++ client library (pulsar-client-cpp/lib/auth/AuthOauth2.cc, fix apache/pulsar#16064), shipped only as the pip wheel pulsar-client; GHSA-5r3h-c3r7-9w4h lists no Maven package. pulsar-client-reactive is a different library and the vulnerable code is absent from its whole dependency closure (18 jars, 13 native binaries, 0 curl/OAuth2 symbols). PoC (poc/CVE-2022-33684): C++ 2.10.1 leaked client_secret to a rogue issuer, the Java stack refused at that same 2.10.1 and at 3.3.3.",
      "vulnerability": {
        "name": "CVE-2022-33684"
      },
      "impact_statement": "false_positive \u2014 CVE-2022-33684 is in the Apache Pulsar C++ client library (pulsar-client-cpp/lib/auth/AuthOauth2.cc, fix apache/pulsar#16064), shipped only as the pip wheel pulsar-client; GHSA-5r3h-c3r7-9w4h lists no Maven package. pulsar-client-reactive is a different library and the vulnerable code is absent from its whole dependency closure (18 jars, 13 native binaries, 0 curl/OAuth2 symbols). PoC (poc/CVE-2022-33684): C++ 2.10.1 leaked client_secret to a rogue issuer, the Java stack refused at that same 2.10.1 and at 3.3.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-30429 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. CVE-2023-30429 is a wrong-project match. The CVE concerns authorization logic in the Apache Pulsar Function Worker (server-side component), but this repository is `pulsar-client-reactive` v0.5.10, a CLIENT library for connecting to Pulsar servers. The repository contains zero server-side code, no Function Worker components, and no vendored copies of the affected component. This is a wrong-project match.",
      "vulnerability": {
        "name": "CVE-2023-30429"
      },
      "impact_statement": "CVE-2023-30429 is a wrong-project match. The CVE concerns authorization logic in the Apache Pulsar Function Worker (server-side component), but this repository is `pulsar-client-reactive` v0.5.10, a CLIENT library for connecting to Pulsar servers. The repository contains zero server-side code, no Function Worker components, and no vendored copies of the affected component. This is a wrong-project match."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-31007 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. false_positive \u2014 CVE-2023-31007 is a false positive for this repository. The CVE affects Apache Pulsar Broker (server-side authentication component), but this repository is Apache Pulsar Reactive Client v0.5.10 (client library). The vulnerable component code is completely absent from this repository - no broker code, no authenticateOriginalAuthData configuration, and no authentication expiration logic exists in...",
      "vulnerability": {
        "name": "CVE-2023-31007"
      },
      "impact_statement": "false_positive \u2014 CVE-2023-31007 is a false positive for this repository. The CVE affects Apache Pulsar Broker (server-side authentication component), but this repository is Apache Pulsar Reactive Client v0.5.10 (client library). The vulnerable component code is completely absent from this repository - no broker code, no authenticateOriginalAuthData configuration, and no authentication expiration logic exists in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-37544 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. CVE-2023-37544 describes a vulnerability in Apache Pulsar WebSocket Proxy server component's /pingpong endpoint. pulsar-client-reactive is a reactive client library for Apache Pulsar, not the WebSocket Proxy server. It contains no WebSocket Proxy code, no /pingpong endpoint and no server-side WebSocket handling: all of its sources live under org/apache/pulsar/reactive/client, and its only Apache Pulsar dependencies are org.apache.pulsar:pulsar-client-api and the shaded org.apache.pulsar:pulsar-client, neither of which carries the WebSocket Proxy. The vulnerability therefore does not apply to this library in any version.",
      "vulnerability": {
        "name": "CVE-2023-37544"
      },
      "impact_statement": "CVE-2023-37544 describes a vulnerability in Apache Pulsar WebSocket Proxy server component's /pingpong endpoint. pulsar-client-reactive is a reactive client library for Apache Pulsar, not the WebSocket Proxy server. It contains no WebSocket Proxy code, no /pingpong endpoint and no server-side WebSocket handling: all of its sources live under org/apache/pulsar/reactive/client, and its only Apache Pulsar dependencies are org.apache.pulsar:pulsar-client-api and the shaded org.apache.pulsar:pulsar-client, neither of which carries the WebSocket Proxy. The vulnerability therefore does not apply to this library in any version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-37579 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. CVE-2023-37579 is a wrong-project match. The CVE affects the Apache Pulsar Function Worker (server-side component that manages Pulsar Functions, Sources, and Sinks), but this repository is the Apache Pulsar Reactive Client library (version 0.5.10), a client-side library for reactive messaging. The vulnerable component (Function Worker with its admin REST API endpoints for source/sink configuration retrieval) is completely absent from this repository, its source code, and all dependencies.",
      "vulnerability": {
        "name": "CVE-2023-37579"
      },
      "impact_statement": "CVE-2023-37579 is a wrong-project match. The CVE affects the Apache Pulsar Function Worker (server-side component that manages Pulsar Functions, Sources, and Sinks), but this repository is the Apache Pulsar Reactive Client library (version 0.5.10), a client-side library for reactive messaging. The vulnerable component (Function Worker with its admin REST API endpoints for source/sink configuration retrieval) is completely absent from this repository, its source code, and all dependencies."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-51437 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.1. CVE-2023-51437 is a false positive for this repository. The CVE affects the Apache Pulsar SASL Authentication Provider in server-side components (Broker, Proxy, Websocket Proxy, Function Worker). This repository is pulsar-client-reactive version 0.5.10, a client library that provides Reactive Streams adapter for the Apache Pulsar Java client. The vulnerable server-side SASL authentication provider code does not exist anywhere in this client library codebase.",
      "vulnerability": {
        "name": "CVE-2023-51437"
      },
      "impact_statement": "CVE-2023-51437 is a false positive for this repository. The CVE affects the Apache Pulsar SASL Authentication Provider in server-side components (Broker, Proxy, Websocket Proxy, Function Worker). This repository is pulsar-client-reactive version 0.5.10, a client library that provides Reactive Streams adapter for the Apache Pulsar Java client. The vulnerable server-side SASL authentication provider code does not exist anywhere in this client library codebase."
    }
  ]
}