{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7a310936-47df-5adb-a64b-4893886e39f0",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3",
      "type": "library",
      "group": "io.netty",
      "name": "netty-codec-xml",
      "version": "4.1.73.Final-tuxcare.3",
      "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:0f55dff5-c5a4-5925-967f-a60a19d27f3b",
      "id": "CVE-2022-24823",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-24823 is fixed in version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e6c4e183-dba9-588a-8157-38bb4a0b855e",
      "id": "CVE-2022-41881",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-41881 is fixed in version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:942f08b9-46a6-5708-8165-3cf96969f5f7",
      "id": "CVE-2022-41915",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-41915 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:026ac6e2-fe94-5eb8-abf4-1d31f1a54b62",
      "id": "CVE-2023-34462",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34462 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0bc5c635-09a3-573c-a5ba-6387a5a421d2",
      "id": "CVE-2023-44487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-44487 is fixed in version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1d56ea56-92ce-5d07-9d6d-afa937cb77c0",
      "id": "CVE-2023-4586",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-xml 4.1.73.Final-tuxcare.3."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:247eb11d-b3ae-504b-acbd-0609e655bde8",
      "id": "CVE-2024-29025",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-29025 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f65e6546-8fd8-5d2b-9a0e-8e7271467677",
      "id": "CVE-2024-47535",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-47535 is fixed in version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b1261d76-2d96-54ce-bd2e-18b0e1ffd8c9",
      "id": "CVE-2025-24970",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24970 is fixed in version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d890f6d9-03fe-5064-a21a-2af51f0b63f6",
      "id": "CVE-2025-25193",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-25193 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f3aba868-fc62-5469-902a-7ee92a3c35f1",
      "id": "CVE-2025-55163",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55163 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6c201274-41f9-5c0c-8a46-3b1b7c10a8ae",
      "id": "CVE-2025-58056",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58056 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f9ce27ee-2602-5444-9aef-3a1ac7288581",
      "id": "CVE-2025-58057",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58057 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:19083a78-c520-5228-b6be-9471ffb1805f",
      "id": "CVE-2025-59419",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59419 is fixed in version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:00ba86e4-5711-5188-bc41-fd049508f1b5",
      "id": "CVE-2025-67735",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-67735 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8175352e-9a40-55a0-861c-0c4f29a6d6e5",
      "id": "CVE-2026-33870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33870 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:acba45e6-fb56-5bb2-9c41-edfb34960e1d",
      "id": "CVE-2026-33871",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33871 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5794f779-bfc4-5285-bbfd-f093f64219f1",
      "id": "CVE-2026-41417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41417 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96df1e06-dee0-59f4-b999-12ff88db4f27",
      "id": "CVE-2026-42577",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42577 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb2b5ddc-8b60-5c70-b339-e23401927ebe",
      "id": "CVE-2026-42578",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42578 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:37f74f8a-b9a7-5b86-96f6-cf054f6a491a",
      "id": "CVE-2026-42579",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42579 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d3051f2a-e1e2-5920-b924-e601951e9d7f",
      "id": "CVE-2026-42580",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42580 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a5cd5b1-316b-5bfa-9980-d884c9ac2b80",
      "id": "CVE-2026-42581",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42581 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d8f3420a-a848-5bc6-a06c-9f5f2b0678a9",
      "id": "CVE-2026-42583",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42583 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb6fbb66-7563-57af-a72c-62021268312f",
      "id": "CVE-2026-42584",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42584 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:47424f8f-6058-5731-9823-f745ac629dc7",
      "id": "CVE-2026-42585",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42585 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:143af0e7-bb61-53c8-b148-5d307adf4431",
      "id": "CVE-2026-42586",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42586 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:28d0d636-7d00-50d3-a331-d8a2bf94afe1",
      "id": "CVE-2026-42587",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42587 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:702a7800-c008-566f-84a6-7787210cf5dd",
      "id": "CVE-2026-44248",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44248 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ff8e4717-8321-5744-bc21-fd6e17d8eee5",
      "id": "CVE-2026-44249",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44249 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cf74d5fe-66c5-5ec5-b769-12b0c8563c6d",
      "id": "CVE-2026-44250",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44250 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a10898e4-703a-5d55-a007-94454bacea43",
      "id": "CVE-2026-44890",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44890 is fixed in version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:53988c72-6b21-5097-9649-742b4367cde4",
      "id": "CVE-2026-44891",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44891 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:87182687-d355-581b-9b7f-a5c99a8500d5",
      "id": "CVE-2026-44893",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44893 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:90ee27d4-a257-52e0-85ba-30046fa66f7c",
      "id": "CVE-2026-45416",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45416 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3089e756-4665-5454-b7fc-051940e0be29",
      "id": "CVE-2026-45536",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45536 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ccaf1e8c-969a-51e1-90cf-c0ddb5e7523d",
      "id": "CVE-2026-45673",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45673 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f3663118-3a42-5c1c-8766-e628f8f6ae79",
      "id": "CVE-2026-45674",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45674 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1710e4dc-2a39-5237-b20f-2f43720e9df1",
      "id": "CVE-2026-46340",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46340 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bbdc7f55-3535-5f0c-a6a4-9ce13eadaeb0",
      "id": "CVE-2026-47244",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47244 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a1214479-6723-5c7e-870e-e83054e65236",
      "id": "CVE-2026-47691",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47691 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f2fc3d64-e815-515d-8c05-8cccdd164822",
      "id": "CVE-2026-48006",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48006 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b371ecbc-64f6-5cec-8d71-36c143548d44",
      "id": "CVE-2026-48043",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48043 does not affect version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml. not_affected \u2014 Version 4.1.73 is not affected by CVE-2026-48043. The target uses a loop-based architecture with try-finally protection (introduced in 2016) that prevents the buffer leak described in the CVE. The vulnerable ChannelInboundHandlerAdapter pattern that the upstream patch fixes does not exist in this version."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:300040cd-c5f8-5fb6-b59e-dfe417656c8e",
      "id": "CVE-2026-48059",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48059 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f1243a4b-606e-5822-a23e-e9bc7d7ea39b",
      "id": "CVE-2026-50010",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50010 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:76793efd-699b-5499-ad9b-6d561cd93ccc",
      "id": "CVE-2026-50011",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50011 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c8246c48-4b9c-5c57-a312-350135e81f91",
      "id": "CVE-2026-50020",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50020 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f623f734-4fc2-52ce-9379-bf0ff40cda18",
      "id": "CVE-2026-50560",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50560 is fixed in version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4699529d-7d6a-56b3-b5e2-ce4a8bcb541e",
      "id": "CVE-2026-55831",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55831 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f02060b0-3ba8-5d22-86b5-fb88a9fbf794",
      "id": "CVE-2026-55833",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55833 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0fb5e843-7f16-5aee-892f-f6bdd241f0be",
      "id": "CVE-2026-55851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55851 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:59e21ff4-d064-5f07-92ba-f551ca0d8b4c",
      "id": "CVE-2026-56745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56745 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a53aa21c-f0c2-55bc-933c-8f9b97fb506d",
      "id": "CVE-2026-56746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56746 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:19614589-a3e8-5bbc-a612-8f6e378f3499",
      "id": "CVE-2026-56817",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56817 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c0a55671-df1e-5fc4-9764-089d5df4c15d",
      "id": "CVE-2026-56818",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56818 does not affect version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml. not_affected \u2014 The target version 4.1.73.Final-tuxcare.2 is NOT AFFECTED by CVE-2026-56818. The vulnerable code pattern (configurable `maxElements` limit check without cleanup, contrasting with `maxNestedArrayDepth` limit check WITH cleanup) was introduced in version 4.1.135.Final through commits e51c64c964 and 728c98b8ec (dated 2026-06-01/02). The target version predates these features entirely and does not ..."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1cae5ea9-de85-5d1e-997b-707b55883841",
      "id": "CVE-2026-56819",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56819 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e1aa1456-e00c-57ed-8541-4ecc70106cf4",
      "id": "CVE-2026-59898",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59898 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4e13028e-a100-5f01-96e8-c5e2d8eedae5",
      "id": "CVE-2026-59899",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59899 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:709aee66-1baf-57b6-8af3-9dfccd20e659",
      "id": "CVE-2026-59900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59900 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:83714798-1a69-53ef-9b4b-4c2fb0eac62e",
      "id": "CVE-2026-59901",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59901 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f39ade1b-7649-51d0-9ae8-34ac0381bcf8",
      "id": "CVE-2026-59919",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59919 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:47c9b76d-7f3c-57da-8308-6cad090ab147",
      "id": "CVE-2026-59920",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59920 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:82d0ae03-75d7-5cd0-bf9d-76843060bc87",
      "id": "CVE-2026-59921",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59921 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f605c272-9cab-515d-8ba4-ee9ae7720db0",
      "id": "CVE-2026-73507",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73507 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2393f9a6-6bb2-59bc-a7e6-ab4078ca5ac5",
      "id": "CVE-2026-73508",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73508 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6c33aa65-e1d6-55b3-90d4-78a02aeae09b",
      "id": "GHSA-mfg7-5gfp-c4w3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5af0a009-5e44-5616-b173-dea3fc02b041",
      "id": "GHSA-v74w-7mr3-4qg3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:73fcf0c4-c4f3-5068-be1c-ce3836cff885",
      "id": "GHSA-xpw8-rcwv-8f8p",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.73.Final-tuxcare.3 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.3"
    }
  ]
}