{
  "@id": "urn:uuid:afd6f24c-6514-4021-870a-4ed6634cafb5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-46340 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp. already_fixed \u2014 CVE-2026-46340 is NOT present in the target. The target version 4.1.135.Final already contains the complete upstream fix from commit cef5395186. The vulnerable nested CompositeByteBuf wrapping pattern has been replaced with flat ArrayList collection, and limits on concurrent incomplete messages (128) and fragments per message (128) are enforced.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-46340"
      },
      "impact_statement": "already_fixed \u2014 CVE-2026-46340 is NOT present in the target. The target version 4.1.135.Final already contains the complete upstream fix from commit cef5395186. The vulnerable nested CompositeByteBuf wrapping pattern has been replaced with flat ArrayList collection, and limits on concurrent incomplete messages (128) and fragments per message (128) are enforced."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "CVE-2026-59902"
      },
      "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-transport-sctp@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-sctp.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}