{
  "@id": "urn:uuid:281005d4-e711-4c55-b2de-832c0deb5590",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis. not_affected \u2014 CVE-2025-25193 addresses a bug in the BoundedInputStream class where null bytes (0x00) were not counted toward the read limit due to incorrect conditional logic (if b > 0 instead of if b != -1). This class does not exist in Netty 4.1.49.Final. BoundedInputStream was first introduced in CVE-2024-47535 fixes and backported only to versions 4.1.52.Final and later. Since the vulnerable code compone...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-25193 addresses a bug in the BoundedInputStream class where null bytes (0x00) were not counted toward the read limit due to incorrect conditional logic (if b > 0 instead of if b != -1). This class does not exist in Netty 4.1.49.Final. BoundedInputStream was first introduced in CVE-2024-47535 fixes and backported only to versions 4.1.52.Final and later. Since the vulnerable code compone..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42577 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-42577"
      },
      "action_statement": "Vulnerability CVE-2026-42577 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis, and is fixed in 4.1.49.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42586"
      },
      "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis, and is fixed in 4.1.49.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-44250"
      },
      "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-44890"
      },
      "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-48006"
      },
      "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-50011"
      },
      "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56818 does not affect version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis. not_affected \u2014 CVE-2026-56818 describes a resource leak in RedisArrayAggregator where the maxElements limit check throws without calling releaseAndClearDepths(), while the maxNestedArrayDepth limit check properly cleans up. The target version (4.1.49.Final at SHA 3ff20edafd) does not contain these features - they were added in later commits (e51c64c964 adding maxElements, 728c98b8ec adding maxNestedArrayDepth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-56818"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-56818 describes a resource leak in RedisArrayAggregator where the maxElements limit check throws without calling releaseAndClearDepths(), while the maxNestedArrayDepth limit check properly cleans up. The target version (4.1.49.Final at SHA 3ff20edafd) does not contain these features - they were added in later commits (e51c64c964 adding maxElements, 728c98b8ec adding maxNestedArrayDepth..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.49.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.49.Final-tuxcare.3 of io.netty:netty-codec-redis."
    }
  ]
}