{
  "@id": "urn:uuid:a8103e99-52e0-48ac-b729-8213008788f3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T11:37:00.140949+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:24:00.148485+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks. not_affected \u2014 CVE-2024-47535 (DoS via unbounded file reads during Netty startup on Windows) is NOT PRESENT in this target. The upstream fix (BoundedInputStream wrapper limiting file reads to 8KB-1MB) was authored by Norman Maurer and shipped in Netty 4.1.130.Final before TuxCare onboarded the version. All three vulnerable file-reading code paths (PlatformDependent.java reading /etc/os-release, NetUtil.java r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-47535 (DoS via unbounded file reads during Netty startup on Windows) is NOT PRESENT in this target. The upstream fix (BoundedInputStream wrapper limiting file reads to 8KB-1MB) was authored by Norman Maurer and shipped in Netty 4.1.130.Final before TuxCare onboarded the version. All three vulnerable file-reading code paths (PlatformDependent.java reading /etc/os-release, NetUtil.java r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:37:00.140949+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks. not_affected \u2014 The target Netty 4.1.130.Final-tuxcare.4 is NOT AFFECTED by CVE-2025-25193. The vulnerability (null-bytes not counted against input limit in BoundedInputStream) was fixed in upstream commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386, which shipped in Netty 4.1.118.Final. The target version 4.1.130.Final inherited this fix from upstream before TuxCare onboarded it (commit c7c85999). The current co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.1.130.Final-tuxcare.4 is NOT AFFECTED by CVE-2025-25193. The vulnerability (null-bytes not counted against input limit in BoundedInputStream) was fixed in upstream commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386, which shipped in Netty 4.1.118.Final. The target version 4.1.130.Final inherited this fix from upstream before TuxCare onboarded it (commit c7c85999). The current co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:14:00.209703+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks. not_affected \u2014 CVE-2025-58057 describes a decompression bomb vulnerability in BrotliDecoder where unbounded buffer accumulation leads to OOM. The target repository (Netty 4.1.130.Final) is not affected because the vulnerable pattern was already fixed by upstream in commit 34894ac73b02efefeacd9c0972780b32dc3de04f, which shipped with the 4.1.130.Final release that TuxCare onboarded. The fix changes BrotliDecode...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-58057 describes a decompression bomb vulnerability in BrotliDecoder where unbounded buffer accumulation leads to OOM. The target repository (Netty 4.1.130.Final) is not affected because the vulnerable pattern was already fixed by upstream in commit 34894ac73b02efefeacd9c0972780b32dc3de04f, which shipped with the 4.1.130.Final release that TuxCare onboarded. The fix changes BrotliDecode..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 is fixed in version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-socks@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-socks, and is fixed in 4.1.130.Final-tuxcare.3."
    }
  ]
}