{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://fermihdi.io/vex/702aae71376711a45b3f9ac6489ceab9",
  "author": "FermiHDI",
  "role": "Software vendor",
  "timestamp": "2026-09-15T14:59:53Z",
  "version": 1,
  "tooling": "Trivy findings triaged by package reachability",
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-85091"
      },
      "products": [
        {
          "@id": "pkg:oci/enrichment@sha256:02aff37586beb296d536f60a6233c189135e74a92d62b6eddf5b40bc46378c96?repository_url=cr.fermihdi.io/hd/enrichment",
          "subcomponents": [
            {
              "@id": "pkg:apk/wolfi/zlib@1.3.2-r7?arch=x86_64&distro=20230201"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The overflow is in zlib's gz* file API (gz_vacate, reached through gzwrite/gzprintf/gzvprintf on a non-blocking gzFile). No executable or shared object in the image imports any gz* symbol (checked with nm -D over every ELF file): CPython's zlib extension links only deflate, inflate, crc32 and adler32, and the enrichment service's only use of gzip is kafka-python's optional gzip codec, which uses Python's pure-Python gzip module on top of those calls. The vulnerable code is never run.",
      "timestamp": "2026-09-15T14:59:53Z"
    }
  ]
}