{
  "@id": "urn:uuid:8c9b0a29-c6c4-41de-a535-040b7c0dd8ce",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:43:58.356192+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:46:32.051982+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:43:58.356192+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:43:58.356192+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:43:58.356192+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:43:58.356192+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:43:58.356192+00:00",
      "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt. not_affected \u2014 Target version 4.1.31.Final implements only MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections. CVE-2026-44248 specifically affects MQTT 5 Properties parsing (introduced in Netty 4.1.52.Final, 21 versions after the target). The vulnerable code pattern (unbounded Properties section parsing via decodeProperties() method) is not present in the target codebase. Type A1 verification: exh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44248"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.31.Final implements only MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections. CVE-2026-44248 specifically affects MQTT 5 Properties parsing (introduced in Netty 4.1.52.Final, 21 versions after the target). The vulnerable code pattern (unbounded Properties section parsing via decodeProperties() method) is not present in the target codebase. Type A1 verification: exh..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.31.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:43:58.356192+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec-mqtt."
    }
  ]
}