{ "@id": "urn:uuid:903e74a0-c3fd-40aa-8d71-635af40d2f8f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-19T06:28:00.064540+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2024-23445 does not affect version 8.13.4-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 CVE-2024-23445 is a server-side Elasticsearch enforcement bug (cross-cluster API key search restrictions bypassed when replication is also granted). The supplied vendor patch (elasticsearch-java commit 7778655 \"field_security fix\") is a client-library data-model correction: it changes IndicesPrivileges.field_security from List (serialized as a JSON array) to a single nullable FieldSecurity object (seri [VC re-run with claude-opus-4-8, prod prompt f71480c, 2026-09-11; applied manually after git verification]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-23445" }, "impact_statement": "not_affected \u2014 CVE-2024-23445 is a server-side Elasticsearch enforcement bug (cross-cluster API key search restrictions bypassed when replication is also granted). The supplied vendor patch (elasticsearch-java commit 7778655 \"field_security fix\") is a client-library data-model correction: it changes IndicesPrivileges.field_security from List (serialized as a JSON array) to a single nullable FieldSecurity object (seri [VC re-run with claude-opus-4-8, prod prompt f71480c, 2026-09-11; applied manually after git verification]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2024-37280 is a false positive for co.elastic.clients:elasticsearch-java 8.13.4-tuxcare.1. false_positive \u2014 CVE-2024-37280 is a wrong-project match. The CVE affects Elasticsearch SERVER (elastic/elasticsearch) where document ingestion with passthrough-type field mappings causes StackOverflow. This repository is the Elasticsearch Java CLIENT (elastic/elasticsearch-java version 8.13.4), a client library that only sends HTTP requests to the server. The client does not perform document ingestion or serve...", "vulnerability": { "name": "CVE-2024-37280" }, "impact_statement": "false_positive \u2014 CVE-2024-37280 is a wrong-project match. The CVE affects Elasticsearch SERVER (elastic/elasticsearch) where document ingestion with passthrough-type field mappings causes StackOverflow. This repository is the Elasticsearch Java CLIENT (elastic/elasticsearch-java version 8.13.4), a client library that only sends HTTP requests to the server. The client does not perform document ingestion or serve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2024-52979 does not affect version 8.13.4-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 The Elasticsearch Java Client v8.13.4 is NOT AFFECTED by CVE-2024-52979. This CVE concerns server-side Mustache template evaluation in Elasticsearch server that can cause resource exhaustion and node crashes. This repository contains the Java CLIENT library, which only constructs and sends HTTP requests to the Elasticsearch server. The client does not contain any Mustache template evaluation co...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2024-52979" }, "impact_statement": "not_affected \u2014 The Elasticsearch Java Client v8.13.4 is NOT AFFECTED by CVE-2024-52979. This CVE concerns server-side Mustache template evaluation in Elasticsearch server that can cause resource exhaustion and node crashes. This repository contains the Java CLIENT library, which only constructs and sends HTTP requests to the Elasticsearch server. The client does not contain any Mustache template evaluation co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2024-52980 is a false positive for co.elastic.clients:elasticsearch-java 8.13.4-tuxcare.1. false_positive \u2014 CVE-2024-52980 is a FALSE POSITIVE for this repository. The CVE describes a vulnerability in the Elasticsearch SERVER's pipeline processing logic (PatternBank class, innerForbidCircularReferences function). This repository is the Elasticsearch Java CLIENT library (version 8.13.4), which only contains data transfer objects (DTOs) for serializing/deserializing pipeline configurations sent to a re...", "vulnerability": { "name": "CVE-2024-52980" }, "impact_statement": "false_positive \u2014 CVE-2024-52980 is a FALSE POSITIVE for this repository. The CVE describes a vulnerability in the Elasticsearch SERVER's pipeline processing logic (PatternBank class, innerForbidCircularReferences function). This repository is the Elasticsearch Java CLIENT library (version 8.13.4), which only contains data transfer objects (DTOs) for serializing/deserializing pipeline configurations sent to a re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2024-52981 is a false positive for co.elastic.clients:elasticsearch-java 8.13.4-tuxcare.1. false_positive \u2014 CVE-2024-52981 targets the Elasticsearch server's WKT parsing logic for nested GeometryCollection objects causing stack overflow. This repository is the Elasticsearch Java Client (version 8.13.4), a separate product that does not contain any WKT parsing code. The client only handles WKT as plain text strings that are serialized to JSON and sent to the Elasticsearch server via REST API. The vuln...", "vulnerability": { "name": "CVE-2024-52981" }, "impact_statement": "false_positive \u2014 CVE-2024-52981 targets the Elasticsearch server's WKT parsing logic for nested GeometryCollection objects causing stack overflow. This repository is the Elasticsearch Java Client (version 8.13.4), a separate product that does not contain any WKT parsing code. The client only handles WKT as plain text strings that are serialized to JSON and sent to the Elasticsearch server via REST API. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2025-37727 is a false positive for co.elastic.clients:elasticsearch-java 8.13.4-tuxcare.1. false_positive \u2014 CVE-2025-37727 is a wrong-project match for this repository. [VC re-run with claude-opus-4-8, prod prompt f71480c, 2026-09-11; applied manually after git verification]", "vulnerability": { "name": "CVE-2025-37727" }, "impact_statement": "false_positive \u2014 CVE-2025-37727 is a wrong-project match for this repository. [VC re-run with claude-opus-4-8, prod prompt f71480c, 2026-09-11; applied manually after git verification]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2025-37731 is a false positive for co.elastic.clients:elasticsearch-java 8.13.4-tuxcare.1. false_positive \u2014 CVE-2025-37731 is a false positive for this repository. The vulnerability concerns the Elasticsearch server's PKI realm authentication mechanism, but this repository is the Elasticsearch Java Client - a client library for making API calls to Elasticsearch servers. The PKI realm authentication logic (the vulnerable component) is implemented server-side in the Elasticsearch server codebase, not i...", "vulnerability": { "name": "CVE-2025-37731" }, "impact_statement": "false_positive \u2014 CVE-2025-37731 is a false positive for this repository. The vulnerability concerns the Elasticsearch server's PKI realm authentication mechanism, but this repository is the Elasticsearch Java Client - a client library for making API calls to Elasticsearch servers. The PKI realm authentication logic (the vulnerable component) is implemented server-side in the Elasticsearch server codebase, not i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2025-68384 does not affect version 8.13.4-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 CVE-2025-68384 affects the BufferedByteConsumer class in the rest5_client.low_level package, which does not exist in elasticsearch-java version 8.13.4. This version uses the older elasticsearch-rest-client:8.10.0 dependency (Apache HttpComponents-based architecture) where response buffering is handled by external HeapBufferedAsyncResponseConsumer. The vulnerable code path requiring cumulative b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68384" }, "impact_statement": "not_affected \u2014 CVE-2025-68384 affects the BufferedByteConsumer class in the rest5_client.low_level package, which does not exist in elasticsearch-java version 8.13.4. This version uses the older elasticsearch-rest-client:8.10.0 dependency (Apache HttpComponents-based architecture) where response buffering is handled by external HeapBufferedAsyncResponseConsumer. The vulnerable code path requiring cumulative b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T06:28:00.064540+00:00", "status_notes": "Vulnerability CVE-2025-68390 does not affect version 8.13.4-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 Version 8.13.4 is NOT AFFECTED. The vulnerable component (BufferedByteConsumer in rest5_client package) was introduced almost a year after this version's release. The target uses the older RestClient architecture which does not contain the flawed buffer limit check that allows chunked data to bypass accumulation limits. The vulnerability exists only in versions that include the Rest5Client impl...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-68390" }, "impact_statement": "not_affected \u2014 Version 8.13.4 is NOT AFFECTED. The vulnerable component (BufferedByteConsumer in rest5_client package) was introduced almost a year after this version's release. The target uses the older RestClient architecture which does not contain the flawed buffer limit check that allows chunked data to bypass accumulation limits. The vulnerability exists only in versions that include the Rest5Client impl..." } ] }