CVE-2021-26291

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>maven363</name>
	<range><lt>3.8.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Apache Maven will follow repositories that are defined in a
	dependency’s Project Object Model (pom) which may be surprising to
	some users, resulting in potential risk if a malicious actor takes
	over that repository or is able to insert themselves into a position
	to pretend to be that repository. Maven is changing the default
	behavior in 3.8.1+ to no longer follow http (non-SSL) repository
	references by default. More details available in the referenced urls.
	If you are currently using a repository manager to govern the
	repositories used by your builds, you are unaffected by the risks
	present in the legacy behavior, and are unaffected by this
	vulnerability and change to default behavior. See this link for more
	information about repository management:
	https://maven.apache.org/repository-management.html</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2021-26291</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2021-26291</url>
    </references>
    <dates>
      <discovery>2021-04-23</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>