{
  "@id": "urn:uuid:7b5d3d26-aaf2-43a7-9d5b-72b47988011a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-09-24T09:31:26.931840+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly/wildfly-microprofile-metrics-smallrye@27.0.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly/wildfly-microprofile-metrics-smallrye@27.0.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 27.0.1.Final-tuxcare.1 of org.wildfly:wildfly-microprofile-metrics-smallrye. Version 27.0.1.Final is not affected by CVE-2007-1651: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "Version 27.0.1.Final is not affected by CVE-2007-1651: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly/wildfly-microprofile-metrics-smallrye@27.0.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly/wildfly-microprofile-metrics-smallrye@27.0.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.wildfly:wildfly-microprofile-metrics-smallrye 27.0.1.Final-tuxcare.1. false_positive \u2014 CVE-2007-1652 concerns the legacy OpenID 1.0/2.0 authentication protocol and its library implementations from 2007. WildFly is a Java EE/Jakarta EE application server, not an OpenID library. The repository contains only OpenID Connect (OIDC) support, which is a completely different and modern protocol. No OpenID 1.0/2.0 library code exists in this repository.",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "false_positive \u2014 CVE-2007-1652 concerns the legacy OpenID 1.0/2.0 authentication protocol and its library implementations from 2007. WildFly is a Java EE/Jakarta EE application server, not an OpenID library. The repository contains only OpenID Connect (OIDC) support, which is a completely different and modern protocol. No OpenID 1.0/2.0 library code exists in this repository."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly/wildfly-microprofile-metrics-smallrye@27.0.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly/wildfly-microprofile-metrics-smallrye@27.0.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-0866 affects version 27.0.1.Final-tuxcare.1 of org.wildfly:wildfly-microprofile-metrics-smallrye.",
      "vulnerability": {
        "name": "CVE-2022-0866"
      },
      "action_statement": "Vulnerability CVE-2022-0866 affects version 27.0.1.Final-tuxcare.1 of org.wildfly:wildfly-microprofile-metrics-smallrye."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly/wildfly-microprofile-metrics-smallrye@27.0.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly/wildfly-microprofile-metrics-smallrye@27.0.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-2251 affects version 27.0.1.Final-tuxcare.1 of org.wildfly:wildfly-microprofile-metrics-smallrye.",
      "vulnerability": {
        "name": "CVE-2025-2251"
      },
      "action_statement": "Vulnerability CVE-2025-2251 affects version 27.0.1.Final-tuxcare.1 of org.wildfly:wildfly-microprofile-metrics-smallrye."
    }
  ]
}