{
  "@id": "urn:uuid:85bc50fb-2e12-4e5a-b115-5439f1d07af1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:19:09.619561+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:19:30.173236+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2022-41881"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Version 4.1.39.Final is not affected by CVE-2025-25193. The vulnerability exists in the BoundedInputStream class, which does not exist in this version. BoundedInputStream was introduced in a later version (between 4.1.39.Final and 4.1.118.Final) as part of the fix for CVE-2024-47535 (GHSA-xq3w-v528-46rv). Since the vulnerable component is not present in the codebase, this version cannot be affe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.39.Final is not affected by CVE-2025-25193. The vulnerability exists in the BoundedInputStream class, which does not exist in this version. BoundedInputStream was introduced in a later version (between 4.1.39.Final and 4.1.118.Final) as part of the fix for CVE-2024-47535 (GHSA-xq3w-v528-46rv). Since the vulnerable component is not present in the codebase, this version cannot be affe..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:19:09.619561+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:19:30.173236+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Target version 4.1.39.Final is not affected by CVE-2026-59919. The vulnerability requires BOTH (1) accepting AF_UNIX addresses with CRLF characters AND (2) encoding them into HAProxy V1 text protocol format. The target has the data flaw (no CRLF validation in HAProxyMessage.checkAddress() at line 421), but lacks the encoding component (HAProxyMessageEncoder) that was added to upstream Netty in ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.39.Final is not affected by CVE-2026-59919. The vulnerability requires BOTH (1) accepting AF_UNIX addresses with CRLF characters AND (2) encoding them into HAProxy V1 text protocol format. The target has the data flaw (no CRLF validation in HAProxyMessage.checkAddress() at line 421), but lacks the encoding component (HAProxyMessageEncoder) that was added to upstream Netty in ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    }
  ]
}