{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://index.boks.sh/vex/rust-cargo-arm64",
  "author": "boks index <https://index.boks.sh>",
  "timestamp": "2026-08-21T07:31:10Z",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-54876"
      },
      "products": [
        {
          "@id": "pkg:cargo/openssl@0.10.81"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The leak is in OCSP response handling, reached from X.509 chain verification\nwhen X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL is set --\nin practice, a TLS client validating a peer certificate. libcrypto.so.3 is\nshipped, so the vulnerable code is present, but nothing in this image can\nreach it: the only libcrypto symbols imported are the message-digest ones.\n\nReaching this bug requires a TLS handshake. An image that imports no TLS,\nOCSP, X.509 or certificate-verification symbol cannot perform one."
    }
  ]
}