{
  "@id": "urn:uuid:f6c4ed11-b3e1-4e9f-81b4-a88ca8263e40",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T11:40:00.088205+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-classes-epoll@4.2.2.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-classes-epoll@4.2.2.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:25:00.081871+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-transport-classes-epoll. not_affected \u2014 CVE-2024-47535 describes unbounded file reading of /etc/os-release and /usr/lib/os-release that can cause OutOfMemoryError when an attacker places a >1GB file at these paths (particularly on Windows). The target repository at version 4.2.2.Final already contains the fix: BoundedInputStream wrapper is applied to all relevant file reads in PlatformDependent.java, NetUtil.java, and ResolvConf.java...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-47535 describes unbounded file reading of /etc/os-release and /usr/lib/os-release that can cause OutOfMemoryError when an attacker places a >1GB file at these paths (particularly on Windows). The target repository at version 4.2.2.Final already contains the fix: BoundedInputStream wrapper is applied to all relevant file reads in PlatformDependent.java, NetUtil.java, and ResolvConf.java..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-classes-epoll@4.2.2.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-classes-epoll@4.2.2.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T11:40:00.088205+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-transport-classes-epoll. not_affected \u2014 CVE-2025-25193 describes a DoS vulnerability where BoundedInputStream failed to count null bytes (0x00) against the configured input limit, allowing attackers to bypass protections by creating large files containing only null bytes. The vulnerability was present when the byte-counting condition was `if (b > 0)`, which excluded zero-value bytes. The upstream fix changed this to `if (b != -1)` to...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-25193 describes a DoS vulnerability where BoundedInputStream failed to count null bytes (0x00) against the configured input limit, allowing attackers to bypass protections by creating large files containing only null bytes. The vulnerability was present when the byte-counting condition was `if (b > 0)`, which excluded zero-value bytes. The upstream fix changed this to `if (b != -1)` to..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-classes-epoll@4.2.2.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-classes-epoll@4.2.2.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:23:08.977637+00:00",
      "status_notes": "Vulnerability CVE-2026-42577 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-transport-classes-epoll.",
      "vulnerability": {
        "name": "CVE-2026-42577"
      },
      "action_statement": "Vulnerability CVE-2026-42577 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-transport-classes-epoll."
    }
  ]
}