{
  "@id": "urn:uuid:9acd19e5-4878-462d-a456-4c97e79e39df",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp. Target version 4.0.56.Final is NOT AFFECTED by CVE-2021-37136. The vulnerable Bzip2Decoder component and all related Bzip2 decompression classes do not exist in Netty 4.0.x series. Bzip2 support was first introduced in Netty 4.1.0.Beta1 (commit f9021a6061), which is not part of the 4.0.x lineage. The target version predates the introduction of Bzip2 functionality and therefore cannot process Bzip2 compressed data or be exploited via this vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "impact_statement": "Target version 4.0.56.Final is NOT AFFECTED by CVE-2021-37136. The vulnerable Bzip2Decoder component and all related Bzip2 decompression classes do not exist in Netty 4.0.x series. Bzip2 support was first introduced in Netty 4.1.0.Beta1 (commit f9021a6061), which is not part of the 4.0.x lineage. The target version predates the introduction of Bzip2 functionality and therefore cannot process Bzip2 compressed data or be exploited via this vulnerability."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "action_statement": "Vulnerability CVE-2025-25193 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp. not_affected \u2014 Version 4.0.56.Final is not affected by CVE-2025-58057. The vulnerability pattern involves accumulating MULTIPLE byte buffers during a single decompression operation. BrotliDecoder (the primary vulnerable component) does not exist in this version. The ZLib decoders present (JdkZlibDecoder, JZlibDecoder) allocate a SINGLE buffer per decode() call and expand it as needed, rather than accumulating...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "impact_statement": "not_affected \u2014 Version 4.0.56.Final is not affected by CVE-2025-58057. The vulnerability pattern involves accumulating MULTIPLE byte buffers during a single decompression operation. BrotliDecoder (the primary vulnerable component) does not exist in this version. The ZLib decoders present (JdkZlibDecoder, JZlibDecoder) allocate a SINGLE buffer per decode() call and expand it as needed, rather than accumulating..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp. Netty version 4.0.56.Final is not affected by CVE-2026-42583. The vulnerable component (Lz4FrameDecoder) does not exist in this version. LZ4 codec support was introduced in Netty 4.1.0.Beta2 and was never added to the 4.0 release line. No LZ4-related code, classes, or dependencies are present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "impact_statement": "Netty version 4.0.56.Final is not affected by CVE-2026-42583. The vulnerable component (Lz4FrameDecoder) does not exist in this version. LZ4 codec support was introduced in Netty 4.1.0.Beta2 and was never added to the 4.0 release line. No LZ4-related code, classes, or dependencies are present in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-46340 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2026-46340"
      },
      "action_statement": "Vulnerability CVE-2026-46340 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp. Version 4.0.56.Final does not contain Bzip2 decompression functionality. The Bzip2Decoder and its vulnerable RLE state machine were added to Netty in version 4.1.0.Beta1 (June 2014), which is in the 4.1.x series. Version 4.0.56.Final is from the older 4.0.x maintenance branch and never received Bzip2 support. The compression package contains only Zlib and Snappy codecs, with a TODO comment confirming bzip2 was planned but not implemented.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "impact_statement": "Version 4.0.56.Final does not contain Bzip2 decompression functionality. The Bzip2Decoder and its vulnerable RLE state machine were added to Netty in version 4.1.0.Beta1 (June 2014), which is in the 4.1.x series. Version 4.0.56.Final is from the older 4.0.x maintenance branch and never received Bzip2 support. The compression package contains only Zlib and Snappy codecs, with a TODO comment confirming bzip2 was planned but not implemented."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59902 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2026-59902"
      },
      "action_statement": "Vulnerability CVE-2026-59902 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    }
  ]
}