{
  "@id": "urn:uuid:e11e9f78-9eee-4192-b628-37a5b1c0ea9a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T11:41:00.087012+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-dns@4.2.12.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-dns@4.2.12.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:27:00.180317+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 does not affect version 4.2.12.Final-tuxcare.1 of io.netty:netty-codec-dns. not_affected \u2014 The target Netty 4.2.12.Final is NOT AFFECTED by CVE-2024-47535. The vulnerability (unbounded file reading causing memory exhaustion) is not present because the upstream fix was already included in the 4.2.12.Final release that TuxCare onboarded. The fix introduces BoundedInputStream to limit file reads during initialization: 8KB for /etc/os-release, /usr/lib/os-release, and /proc/sys/net/core/...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.2.12.Final is NOT AFFECTED by CVE-2024-47535. The vulnerability (unbounded file reading causing memory exhaustion) is not present because the upstream fix was already included in the 4.2.12.Final release that TuxCare onboarded. The fix introduces BoundedInputStream to limit file reads during initialization: 8KB for /etc/os-release, /usr/lib/os-release, and /proc/sys/net/core/..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-dns@4.2.12.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-dns@4.2.12.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:41:00.087012+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.2.12.Final-tuxcare.1 of io.netty:netty-codec-dns. not_affected \u2014 CVE-2025-25193 affects Netty's BoundedInputStream which failed to count null-bytes (0x00) toward the input limit due to the condition `if (b > 0)`, enabling memory exhaustion DoS attacks. The target repository at version 4.2.12.Final is NOT AFFECTED because the vulnerability was fixed by upstream commit be1e00765b (Norman Maurer, 2025-02-10) which changed the byte-counting logic to `if (b != -1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-25193 affects Netty's BoundedInputStream which failed to count null-bytes (0x00) toward the input limit due to the condition `if (b > 0)`, enabling memory exhaustion DoS attacks. The target repository at version 4.2.12.Final is NOT AFFECTED because the vulnerability was fixed by upstream commit be1e00765b (Norman Maurer, 2025-02-10) which changed the byte-counting logic to `if (b != -1..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-dns@4.2.12.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-dns@4.2.12.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:32:19.560894+00:00",
      "status_notes": "Vulnerability CVE-2026-42579 is fixed in version 4.2.12.Final-tuxcare.1 of io.netty:netty-codec-dns.",
      "vulnerability": {
        "name": "CVE-2026-42579"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-dns@4.2.12.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-dns@4.2.12.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:32:19.560894+00:00",
      "status_notes": "Vulnerability CVE-2026-73508 affects version 4.2.12.Final-tuxcare.1 of io.netty:netty-codec-dns.",
      "vulnerability": {
        "name": "CVE-2026-73508"
      },
      "action_statement": "Vulnerability CVE-2026-73508 affects version 4.2.12.Final-tuxcare.1 of io.netty:netty-codec-dns."
    }
  ]
}