{
  "@id": "urn:uuid:e57a562b-55da-4ced-8625-f95fc1352bc1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T21:39:03.942226+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T21:39:03.942226+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T22:07:02.026967+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt, and is fixed in 4.1.43.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt, and is fixed in 4.1.43.Final-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T21:39:03.942226+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt. not_affected \u2014 Version 4.1.43.Final is not affected by CVE-2025-25193. The vulnerability describes a bug in the BoundedInputStream class where null-bytes (0x00) are not counted against the input limit due to incorrect byte-counting logic (using `if (b > 0)` instead of `if (b != -1)`). However, BoundedInputStream does not exist in version 4.1.43.Final at all. BoundedInputStream was introduced in later versions...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.43.Final is not affected by CVE-2025-25193. The vulnerability describes a bug in the BoundedInputStream class where null-bytes (0x00) are not counted against the input limit due to incorrect byte-counting logic (using `if (b > 0)` instead of `if (b != -1)`). However, BoundedInputStream does not exist in version 4.1.43.Final at all. BoundedInputStream was introduced in later versions..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T21:39:03.942226+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T21:39:03.942226+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T21:39:03.942226+00:00",
      "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt. not_affected \u2014 Target version 4.1.43.Final does not support MQTT 5 and lacks the Properties parsing code described in CVE-2026-44248. The vulnerability is specific to MQTT 5's unbounded Properties section in variable headers, causing resource exhaustion through repeated parsing by ReplayingDecoder. This version only supports MQTT 3.1 and MQTT 3.1.1, which use fixed-structure variable headers without Propertie...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44248"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.43.Final does not support MQTT 5 and lacks the Properties parsing code described in CVE-2026-44248. The vulnerability is specific to MQTT 5's unbounded Properties section in variable headers, causing resource exhaustion through repeated parsing by ReplayingDecoder. This version only supports MQTT 3.1 and MQTT 3.1.1, which use fixed-structure variable headers without Propertie..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T21:39:03.942226+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.43.Final-tuxcare.2 of io.netty:netty-codec-mqtt."
    }
  ]
}