{
  "@id": "urn:uuid:39708a7e-1e8f-4154-a48a-78b798edf461",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2019-11284 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2019-11284"
      },
      "action_statement": "Vulnerability CVE-2019-11284 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2020-5403 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2020-5403"
      },
      "action_statement": "Vulnerability CVE-2020-5403 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2020-5404 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2020-5404"
      },
      "action_statement": "Vulnerability CVE-2020-5404 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2022-31684 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2022-31684"
      },
      "action_statement": "Vulnerability CVE-2022-31684 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:18:31.985243+00:00",
      "status_notes": "Vulnerability CVE-2023-34054 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2023-34054"
      },
      "action_statement": "Vulnerability CVE-2023-34054 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:18:31.985243+00:00",
      "status_notes": "Vulnerability CVE-2023-34062 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2023-34062"
      },
      "action_statement": "Vulnerability CVE-2023-34062 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:17:51.035769+00:00",
      "status_notes": "Vulnerability CVE-2025-22227 does not affect version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty. not_affected \u2014 CVE-2025-22227: The vulnerability (credential leakage during chained redirects with HTTP/2 upgrade) is NOT present in reactor-netty 1.2.18. The fix was shipped in the upstream 1.2.18 release and was authored by upstream contributor Violeta Georgieva (commit 522892307). TuxCare onboarded version 1.2.18 which already included this fix. The target code properly copies connection state during HTTP/...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22227"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22227: The vulnerability (credential leakage during chained redirects with HTTP/2 upgrade) is NOT present in reactor-netty 1.2.18. The fix was shipped in the upstream 1.2.18 release and was authored by upstream contributor Violeta Georgieva (commit 522892307). TuxCare onboarded version 1.2.18 which already included this fix. The target code properly copies connection state during HTTP/..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:55:00.657167+00:00",
      "status_notes": "Vulnerability CVE-2026-41715 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2026-41715"
      },
      "action_statement": "Vulnerability CVE-2026-41715 affects version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:56:00.093043+00:00",
      "status_notes": "Vulnerability CVE-2026-47843 is fixed in version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2026-47843"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:56:00.093043+00:00",
      "status_notes": "Vulnerability CVE-2026-47845 is fixed in version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2026-47845"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:56:00.093043+00:00",
      "status_notes": "Vulnerability CVE-2026-47848 is fixed in version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2026-47848"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.projectreactor.netty/reactor-netty@1.2.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:56:00.093043+00:00",
      "status_notes": "Vulnerability CVE-2026-47874 is fixed in version 1.2.18-tuxcare.2 of io.projectreactor.netty:reactor-netty.",
      "vulnerability": {
        "name": "CVE-2026-47874"
      }
    }
  ]
}