{
  "@id": "urn:uuid:b5c13628-65ad-4427-925e-4845f86c02c1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T11:36:00.141938+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T11:20:00.174565+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache. not_affected \u2014 CVE-2024-47535 is NOT present in Netty 4.1.119.Final. The vulnerability (unbounded file reads during initialization leading to OOM DoS) was fixed by upstream commit fbf7a704a8 authored by Norman Maurer (Apple), which introduced BoundedInputStream to limit reads to 8KB default (1MB for resolv.conf). This fix shipped in the upstream 4.1.119.Final release before TuxCare onboarding commit 511e28ce7...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-47535 is NOT present in Netty 4.1.119.Final. The vulnerability (unbounded file reads during initialization leading to OOM DoS) was fixed by upstream commit fbf7a704a8 authored by Norman Maurer (Apple), which introduced BoundedInputStream to limit reads to 8KB default (1MB for resolv.conf). This fix shipped in the upstream 4.1.119.Final release before TuxCare onboarding commit 511e28ce7..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T11:36:00.141938+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache. not_affected \u2014 The target Netty 4.1.119.Final is not affected by CVE-2025-25193. The vulnerability (null-bytes not counted toward input limits in BoundedInputStream) was fixed in upstream commit d1fbda62d3 by Norman Maurer, which changed the byte-counting condition from `if (b > 0)` to `if (b != -1)`. This fix was already present in the upstream Netty 4.1.119.Final release that TuxCare onboarded (commit 511e2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.1.119.Final is not affected by CVE-2025-25193. The vulnerability (null-bytes not counted toward input limits in BoundedInputStream) was fixed in upstream commit d1fbda62d3 by Norman Maurer, which changed the byte-counting condition from `if (b > 0)` to `if (b != -1)`. This fix was already present in the upstream Netty 4.1.119.Final release that TuxCare onboarded (commit 511e2..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-memcache.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}