{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://quench-works.com/vex/metabase/2026-09-28",
  "author": "QuenchWorks <info@quench-works.com>",
  "timestamp": "2026-09-28T00:00:00Z",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2025-59250"
      },
      "products": [
        {
          "@id": "pkg:maven/com.microsoft.sqlserver/mssql-jdbc@13.2.1"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false positive: 13.2.1 is the fixed release. GHSA for CVE-2025-59250 lists the 13.2 range as '>= 13.2.0.jre11, < 13.2.1.jre11', first patched 13.2.1.jre11. The .jre11 suffix is the JRE build flavour, not a version step, and Metabase's jar records the artifact as version=13.2.1 in META-INF/maven/com.microsoft.sqlserver/mssql-jdbc/pom.properties. Trivy then compares 13.2.1 against 13.2.1.jre11 and finds it lower. Scoped to 13.2.1; any other mssql-jdbc version must be re-checked."
    }
  ]
}