{ "@id": "urn:uuid:f819d0e3-e81d-4dcf-879e-a84175edf808", "role": "Document Creator", "author": "https://tuxcare.com", "version": 9, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T15:30:49.741847+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:59.275101+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt. not_affected \u2014 Target version 4.1.23.Final (released April 2018) does not implement MQTT 5 protocol. The vulnerability concerns MQTT 5's Properties section parsing, which was introduced to Netty on 2020-08-31 (commit fb4a57826b), approximately 2.5 years after this version was released. The target only supports MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections in their protocol specifications. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 Target version 4.1.23.Final (released April 2018) does not implement MQTT 5 protocol. The vulnerability concerns MQTT 5's Properties section parsing, which was introduced to Netty on 2020-08-31 (commit fb4a57826b), approximately 2.5 years after this version was released. The target only supports MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections in their protocol specifications. The..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-mqtt." } ] }