{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://fermihdi.io/vex/a2dbb468b74dafc458441ff10288edfd",
  "author": "FermiHDI",
  "role": "Software vendor",
  "timestamp": "2026-09-14T15:11:31Z",
  "version": 1,
  "tooling": "Trivy findings triaged by package reachability",
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-79921"
      },
      "products": [
        {
          "@id": "pkg:oci/otel-collector@sha256:80795c879f9e9538e8f568ba318f31f513355c1522eb39ccdaac019ad39393c5?repository_url=cr.fermihdi.io/hd/otel-collector",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com/rabbitmq/amqp091-go@v1.12.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "github.com/rabbitmq/amqp091-go is compiled into the upstream OpenTelemetry Collector Contrib distribution for its RabbitMQ exporter and receiver. HD's DMS renders the collector configuration and only ever configures the OTLP, OTLP/HTTP, syslog, Prometheus remote-write and Kafka exporters and the OTLP receiver, so no RabbitMQ component is instantiated and the client code is never run.",
      "timestamp": "2026-09-14T15:11:31Z"
    }
  ]
}