{
  "@id": "urn:uuid:d7c32bbf-74e8-4a23-a4f9-d557102badf4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:12:13.809981+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 is fixed in version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml. not_affected \u2014 Version 4.1.48.Final does not contain the BoundedInputStream class that is the subject of CVE-2025-25193. The vulnerability concerns a null-byte counting bug in BoundedInputStream where the check `if (b <= 0)` fails to count null-bytes (b == 0) toward the read limit, allowing attackers to bypass the protection. BoundedInputStream was introduced as part of CVE-2024-47535 fixes and backported to ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.48.Final does not contain the BoundedInputStream class that is the subject of CVE-2025-25193. The vulnerability concerns a null-byte counting bug in BoundedInputStream where the check `if (b <= 0)` fails to count null-bytes (b == 0) toward the read limit, allowing attackers to bypass the protection. BoundedInputStream was introduced as part of CVE-2024-47535 fixes and backported to ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2026-42577 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2026-42577"
      },
      "action_statement": "Vulnerability CVE-2026-42577 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2026-56817"
      },
      "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability CVE-2026-73507 does not affect version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml. not_affected \u2014 Netty 4.1.48.Final-tuxcare.1 is not affected by CVE-2026-73507. While the XmlFrameDecoder class contains the vulnerable CPU exhaustion pattern (unbounded buffer rescanning when processing repeated `</` sequences), Netty is a library that exports this class but does not use it in any production code. Per MRA Type A1, the vulnerable code path (attacker XML input \u2192 XmlFrameDecoder.decode() \u2192 CPU e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73507"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.48.Final-tuxcare.1 is not affected by CVE-2026-73507. While the XmlFrameDecoder class contains the vulnerable CPU exhaustion pattern (unbounded buffer rescanning when processing repeated `</` sequences), Netty is a library that exports this class but does not use it in any production code. Per MRA Type A1, the vulnerable code path (attacker XML input \u2192 XmlFrameDecoder.decode() \u2192 CPU e..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-26T23:11:19.728951+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.5 of io.netty:netty-codec-xml."
    }
  ]
}