{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://data.datagrok.ai/vex/grok_connect_extended/bleeding-edge.json",
  "author": "Datagrok",
  "timestamp": "2026-08-24T01:06:28Z",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2016-20013"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2016-2781"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2017-11164"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2018-5709"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2020-8908"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2021-35515"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2021-35516"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2021-35517"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2021-36090"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2021-39239"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2022-27943"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2022-3219"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2022-41409"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2022-4899"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2023-1370"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2023-29383"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2023-2976"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2023-31486"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2023-47039"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2023-50495"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2024-10041"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2024-21634"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2024-2236"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2024-25710"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2024-29131"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2024-29133"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2024-47554"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2024-56433"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "jetty-http HttpURI lenient authority parsing affects applications that use the HttpURI class programmatically for URI validation/redirect construction. Neither spark-java 2.9.4 route handling nor grok_connect code calls HttpURI (no redirects are ever issued); the fix exists only in jetty 12 (Java 17). Verified 2026-08-13."
    },
    {
      "vulnerability": {
        "name": "CVE-2024-7254"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-15649"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2025-24970"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-48734"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-48924"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2025-5278"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-55163"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-59250"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "mssql-jdbc 12.10.2.jre8 (previously 12.8.2.jre8) is well past the fix wave; scanners mis-order the bare '12.10.2' from the jar's pom.properties against the '12.8.2.jre11' fixed-version string because the .jreN suffix breaks their version comparators (known Trivy/Grype issue: aquasecurity/trivy#9745, anchore/grype#3042). The jre11 artifact cannot be used on the Java-8 runtime. Applies to any X.Y.Z.jre8 >= 12.8.2."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-59419"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-6141"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-68161"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-10050"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "jetty-security Digest-authentication bypass (ISO-8859-1 encoding collision). Fixed only in jetty 12.0.36/12.1.10; 9.4 is EOL (NES-only backport) and jetty 10+ needs Java 11. Not in the execute path: grok_connect configures NO HTTP authentication — spark-java 2.9.4 wires no SecurityHandler/LoginService, so jetty's DigestAuthenticator is never instantiated; the service is cluster-internal with datlas as its only client. Re-review if HTTP auth is ever added or the spark/jetty stack changes. Verified 2026-08-12."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-10532"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Same surface as CVE-2026-9828: object injection via the SimpleSocketServer/SimpleSSLSocketServer receivers, which grok_connect never runs (appender-only logback.xml, no receiver/server components). Fixed only in 1.5.34 (Java 11+). Verified 2026-08-13."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-12087"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-1225"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
      "impact_statement": "logback-core config-processing ACE requires an attacker to MODIFY the logback configuration file. grok_connect's logback.xml is compiled into the read-only shaded jar (src/main/resources/logback.xml), the process runs as the non-root 'grok' user, and the entrypoint sets no -Dlogback.configurationFile override — there is no writable or externally-supplied config path. Fixed only in logback 1.5.25 (Java 11+); 1.3.x is the Java-8 ceiling. Verified 2026-08-13."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-13221"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-13595"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-13757"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-15534"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-18938"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-19487"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
      "impact_statement": "jetty-http request smuggling via chunk-extension quoted-string parsing. No OSS fix exists on the Java-8-compatible jetty 9.4 line (9.4.58.v20250814 is the newest on Maven Central and is in the affected range; the advisory's 9.4.60 fix ships only in the HeroDevs NES fork; jetty 10+ needs Java 11). Not adversary-controllable in our topology: grok_connect listens cluster-internally on :1234 with datlas as its ONLY client, connecting directly with no HTTP intermediary (proxy/LB/cache) in between — request smuggling requires a parsing-differential between two HTTP hops, and user input reaches grok_connect solely inside JSON bodies of datlas-composed requests, never as raw protocol elements. Re-review if grok_connect is ever exposed through an ingress/proxy or the spark-java/jetty stack changes. Verified 2026-08-12."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-27456"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-34477"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-34480"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42250"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42497"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42578"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42579"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42586"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-44248"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-44250"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-44890"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-44891"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-44893"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-45205"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-45536"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-45673"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-45674"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-46340"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-47691"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-48006"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-48059"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-48959"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-48961"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-48962"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-49844"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-50011"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-50560"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-53613"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-53615"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-53910"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54369"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54370"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54371"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54399"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54428"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54514"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54515"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56391"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56392"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56817"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56818"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56820"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56821"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56822"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-57062"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-57432"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-57433"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59902"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59920"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-59949"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-6368"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-64607"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
      "impact_statement": "jetty-server Host/authority desynchronization matters where authority selects behavior: virtual hosts, redirects, caches, reverse-proxy routing, request-log trust. grok_connect has none of these (single spark-java route set, no vhosts, no redirects, no cache) and is cluster-internal with datlas as its only client, connecting directly with no proxy hop whose routing could be confused. No fix on the Java-8-compatible jetty 9.4 line (9.4.58 is the newest on Maven Central; later 9.4.x numbers are the commercial NES fork). Verified 2026-08-13."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-6791"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-7017"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-73507"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-73508"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-75803"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-9538"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "under_investigation"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-9828"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "logback-core HardenedObjectInputStream object-injection is reachable only through the SimpleSocketServer/SimpleSSLSocketServer serialized-event receivers. grok_connect never instantiates them: logback.xml configures only ConsoleAppender, AsyncAppender and the in-process QueryStreamAppender (verified src/main/resources/logback.xml). Fixed only in 1.5.33 (Java 11+). Verified 2026-08-13."
    },
    {
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "products": [
        {
          "@id": "pkg:oci/grok_connect_extended@sha256:b30783f33e33a04d71ee081db0c0e1e6e1ca819a7f68d74786a8ef5322a1a15b?tag=bleeding-edge"
        }
      ],
      "status": "affected",
      "action_statement": "A fix is available in a newer package version; upgrade the affected package."
    }
  ]
}