{
  "@id": "urn:uuid:d824a28e-9fae-4c7d-942e-b36507efe9e6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42586 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the fix for CVE-2026-42586. Commit 56fe0d58caced3b93c839f4d8c7f7f8cefef73d6 applied on 2026-05-04 added CRLF validation to RedisEncoder.writeString() method, which is the exact fix from the upstream vendor patches. The validation prevents command injection in inline/simple Redis messages by rejecting content containing carriage return...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42586"
      },
      "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the fix for CVE-2026-42586. Commit 56fe0d58caced3b93c839f4d8c7f7f8cefef73d6 applied on 2026-05-04 added CRLF validation to RedisEncoder.writeString() method, which is the exact fix from the upstream vendor patches. The validation prevents command injection in inline/simple Redis messages by rejecting content containing carriage return..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44250 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis. already_fixed \u2014 CVE-2026-44250 is NOT present in the target repository. The target already contains both vendor fix patches (commits e51c64c964 and 728c98b8ec) that implement the maxNestedArrayDepth limit to prevent the nested array DoS attack. The RedisArrayAggregator class includes the depth check (lines 112-115) that rejects array headers when nesting exceeds the configured limit (default 1024), preventing ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44250"
      },
      "impact_statement": "already_fixed \u2014 CVE-2026-44250 is NOT present in the target repository. The target already contains both vendor fix patches (commits e51c64c964 and 728c98b8ec) that implement the maxNestedArrayDepth limit to prevent the nested array DoS attack. The RedisArrayAggregator class includes the depth check (lines 112-115) that rejects array headers when nesting exceeds the configured limit (default 1024), preventing ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44890 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis. already_fixed \u2014 CVE-2026-44890 is NOT present in this version. The target repository (Netty 4.1.135.Final) already contains the upstream fix from commit bff98ee51b5d0b7ee25fd5005f2169f2a0467efa. The fix enforces a maximum buffer size limit in RedisDecoder.decodeLength() to prevent unbounded memory accumulation when processing malformed RESP protocol payloads lacking required line terminators.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44890"
      },
      "impact_statement": "already_fixed \u2014 CVE-2026-44890 is NOT present in this version. The target repository (Netty 4.1.135.Final) already contains the upstream fix from commit bff98ee51b5d0b7ee25fd5005f2169f2a0467efa. The fix enforces a maximum buffer size limit in RedisDecoder.decodeLength() to prevent unbounded memory accumulation when processing malformed RESP protocol payloads lacking required line terminators."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48006 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2026-48006. Both vendor patches are present: (1) the handlerRemoved() and channelInactive() cleanup methods that prevent memory leaks when connections close with incomplete Redis array aggregations, and (2) the configurable array size bounds. The fix commits (ced30adba2 and e51c64c964) are confirmed ancestors ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48006"
      },
      "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2026-48006. Both vendor patches are present: (1) the handlerRemoved() and channelInactive() cleanup methods that prevent memory leaks when connections close with incomplete Redis array aggregations, and (2) the configurable array size bounds. The fix commits (ced30adba2 and e51c64c964) are confirmed ancestors ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50011 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis. already_fixed \u2014 The target repository at version 4.1.135.Final already contains the complete fix for CVE-2026-50011. All upstream security patches (commits 728c98b8ec, e51c64c964, bff98ee51b) are present as part of the 4.1.135.Final release. The RedisArrayAggregator now validates array size (maxElements default 1,000,000) and nesting depth (maxNestedArrayDepth default 1024) before ArrayList pre-allocation, pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-50011"
      },
      "impact_statement": "already_fixed \u2014 The target repository at version 4.1.135.Final already contains the complete fix for CVE-2026-50011. All upstream security patches (commits 728c98b8ec, e51c64c964, bff98ee51b) are present as part of the 4.1.135.Final release. The RedisArrayAggregator now validates array size (maxElements default 1,000,000) and nesting depth (maxNestedArrayDepth default 1024) before ArrayList pre-allocation, pre..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56818 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-56818"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}