{
  "@id": "urn:uuid:590ec278-f9ad-404c-9bd2-68537905b2ae",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "action_statement": "Vulnerability CVE-2022-41881 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T23:12:13.809981+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Version 4.1.48.Final does not contain the BoundedInputStream class that is the subject of CVE-2025-25193. The vulnerability concerns a null-byte counting bug in BoundedInputStream where the check `if (b <= 0)` fails to count null-bytes (b == 0) toward the read limit, allowing attackers to bypass the protection. BoundedInputStream was introduced as part of CVE-2024-47535 fixes and backported to ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.48.Final does not contain the BoundedInputStream class that is the subject of CVE-2025-25193. The vulnerability concerns a null-byte counting bug in BoundedInputStream where the check `if (b <= 0)` fails to count null-bytes (b == 0) toward the read limit, allowing attackers to bypass the protection. BoundedInputStream was introduced as part of CVE-2024-47535 fixes and backported to ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42577 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-42577"
      },
      "action_statement": "Vulnerability CVE-2026-42577 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-13T12:23:00.134646+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      },
      "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-13T12:23:00.134646+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      },
      "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Netty 4.1.48.Final is not affected by CVE-2026-59919. The vulnerable component HAProxyMessageEncoder does not exist in this version. The encoder class was added later on April 16, 2020 (one month after 4.1.48.Final release on March 17, 2020). While HAProxyMessage in this version accepts AF_UNIX addresses without CRLF validation, there is no code path that encodes these addresses into HAProxy V1...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.48.Final is not affected by CVE-2026-59919. The vulnerable component HAProxyMessageEncoder does not exist in this version. The encoder class was added later on April 16, 2020 (one month after 4.1.48.Final release on March 17, 2020). While HAProxyMessage in this version accepts AF_UNIX addresses without CRLF validation, there is no code path that encodes these addresses into HAProxy V1..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    }
  ]
}