{
  "@id": "urn:uuid:a39a2b33-9e84-473c-a645-7b8b77a47e4e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns. not_affected \u2014 Version 4.1.24.Final is not affected by CVE-2025-25193. The vulnerable component (BoundedInputStream class) and the vulnerable feature (os-release file reading on Windows) do not exist in this version. These were introduced in Netty 4.1.46.Final (February 2020) and later, approximately 2 years after version 4.1.24.Final was released. Git history analysis confirms that commit 713e0aa68a introduc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.24.Final is not affected by CVE-2025-25193. The vulnerable component (BoundedInputStream class) and the vulnerable feature (os-release file reading on Windows) do not exist in this version. These were introduced in Netty 4.1.46.Final (February 2020) and later, approximately 2 years after version 4.1.24.Final was released. Git history analysis confirms that commit 713e0aa68a introduc..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-42579 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2026-42579"
      },
      "action_statement": "Vulnerability CVE-2026-42579 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2026-45673"
      },
      "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-45674 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns. Version 4.1.24.Final is not affected by CVE-2026-45674 because the vulnerable component (DnsCnameCache) does not exist in this version. The CVE targets DNS cache poisoning via unvalidated CNAME records being cached persistently. While 4.1.24 does process CNAME records in the buildAliasMap method without bailiwick validation, it only creates a transient HashMap scoped to a single resolution\u2014there is no persistent CNAME cache to poison. The DnsCnameCache feature and associated caching logic were introduced in later versions (4.1.52+), which is why those versions received CVE-2026-45674 backports while 4.1.24 did not.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45674"
      },
      "impact_statement": "Version 4.1.24.Final is not affected by CVE-2026-45674 because the vulnerable component (DnsCnameCache) does not exist in this version. The CVE targets DNS cache poisoning via unvalidated CNAME records being cached persistently. While 4.1.24 does process CNAME records in the buildAliasMap method without bailiwick validation, it only creates a transient HashMap scoped to a single resolution\u2014there is no persistent CNAME cache to poison. The DnsCnameCache feature and associated caching logic were introduced in later versions (4.1.52+), which is why those versions received CVE-2026-45674 backports while 4.1.24 did not."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2026-47691"
      },
      "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2026-73508"
      },
      "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-resolver-dns."
    }
  ]
}