{ "@id": "urn:uuid:48243e9e-7029-4892-b1a9-9905c241ae22", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-09-24T22:07:02.026967+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T22:07:02.026967+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21409 is fixed in version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2021-21409" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2021-37136" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2023-34462" }, "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T22:07:02.026967+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2024-29025" }, "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T22:07:02.026967+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.43.Final-tuxcare.1 of io.netty:netty-example. not_affected \u2014 Version 4.1.43.Final is not affected by CVE-2025-25193. The vulnerability describes a bug in the BoundedInputStream class where null-bytes (0x00) are not counted against the input limit due to incorrect byte-counting logic (using `if (b > 0)` instead of `if (b != -1)`). However, BoundedInputStream does not exist in version 4.1.43.Final at all. BoundedInputStream was introduced in later versions...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Version 4.1.43.Final is not affected by CVE-2025-25193. The vulnerability describes a bug in the BoundedInputStream class where null-bytes (0x00) are not counted against the input limit due to incorrect byte-counting logic (using `if (b > 0)` instead of `if (b != -1)`). However, BoundedInputStream does not exist in version 4.1.43.Final at all. BoundedInputStream was introduced in later versions..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55163 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2025-55163" }, "action_statement": "Vulnerability CVE-2025-55163 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2025-58056" }, "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59419 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2025-59419" }, "action_statement": "Vulnerability CVE-2025-59419 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42579 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-42579" }, "action_statement": "Vulnerability CVE-2026-42579 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.43.Final-tuxcare.1 of io.netty:netty-example. not_affected \u2014 Version 4.1.43.Final is NOT affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow detection per Java Language Specification. The vulnerable manual parsing code (result *= 16; result += digit with only negative overflow checking) was introduced later in version 4.1.88.Final as a performance optimization. When the CVE PoC value...", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Version 4.1.43.Final is NOT affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow detection per Java Language Specification. The vulnerable manual parsing code (result *= 16; result += digit with only negative overflow checking) was introduced later in version 4.1.88.Final as a performance optimization. When the CVE PoC value..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.43.Final-tuxcare.1 of io.netty:netty-example. Version 4.1.43.Final does not support brotli, zstd, or snappy HTTP content decompression. The vulnerable code path described in CVE-2026-42587 (HttpContentDecompressor/DelegatingDecompressorFrameListener accepting maxAllocation but ignoring it for br/zstd/snappy encodings) does not exist in this version. Both HTTP/1.1 and HTTP/2 decompressors only support gzip and deflate encodings, returning null for br/zstd/snappy. When a request with Content-Encoding: br/zstd/snappy is received, no decompression occurs, preventing unbounded memory allocation. The decoders for these formats were added in later versions (after 4.1.43.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Version 4.1.43.Final does not support brotli, zstd, or snappy HTTP content decompression. The vulnerable code path described in CVE-2026-42587 (HttpContentDecompressor/DelegatingDecompressorFrameListener accepting maxAllocation but ignoring it for br/zstd/snappy encodings) does not exist in this version. Both HTTP/1.1 and HTTP/2 decompressors only support gzip and deflate encodings, returning null for br/zstd/snappy. When a request with Content-Encoding: br/zstd/snappy is received, no decompression occurs, preventing unbounded memory allocation. The decoders for these formats were added in later versions (after 4.1.43.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.43.Final-tuxcare.1 of io.netty:netty-example. not_affected \u2014 Target version 4.1.43.Final does not support MQTT 5 and lacks the Properties parsing code described in CVE-2026-44248. The vulnerability is specific to MQTT 5's unbounded Properties section in variable headers, causing resource exhaustion through repeated parsing by ReplayingDecoder. This version only supports MQTT 3.1 and MQTT 3.1.1, which use fixed-structure variable headers without Propertie...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 Target version 4.1.43.Final does not support MQTT 5 and lacks the Properties parsing code described in CVE-2026-44248. The vulnerability is specific to MQTT 5's unbounded Properties section in variable headers, causing resource exhaustion through repeated parsing by ReplayingDecoder. This version only supports MQTT 3.1 and MQTT 3.1.1, which use fixed-structure variable headers without Propertie..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T22:07:02.026967+00:00", "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44249" }, "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T22:07:02.026967+00:00", "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44893" }, "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example, and is fixed in 4.1.43.Final-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.43.Final-tuxcare.1 of io.netty:netty-example. Version 4.1.43.Final is not affected by CVE-2026-45416. The vulnerability requires SslClientHelloHandler, which was introduced in February 2020 (commit #9827), four months after 4.1.43.Final was released (October 2019). The target's AbstractSniHandler extends ByteToMessageDecoder and processes ClientHello in-place without eager buffer allocation. The architectural change that introduced the vulnerable pattern (AbstractSniHandler extending SslClientHelloHandler with eager buffer allocation based on handshake length) occurred after this version. The vulnerable code pattern is absent in 4.1.43.Final.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.43.Final is not affected by CVE-2026-45416. The vulnerability requires SslClientHelloHandler, which was introduced in February 2020 (commit #9827), four months after 4.1.43.Final was released (October 2019). The target's AbstractSniHandler extends ByteToMessageDecoder and processes ClientHello in-place without eager buffer allocation. The architectural change that introduced the vulnerable pattern (AbstractSniHandler extending SslClientHelloHandler with eager buffer allocation based on handshake length) occurred after this version. The vulnerable code pattern is absent in 4.1.43.Final." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45674 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-45674" }, "action_statement": "Vulnerability CVE-2026-45674 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46340 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-46340" }, "action_statement": "Vulnerability CVE-2026-46340 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-48059" }, "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56818 does not affect version 4.1.43.Final-tuxcare.1 of io.netty:netty-example. not_affected \u2014 Version 4.1.43.Final is not affected by CVE-2026-56818. The vulnerable code pattern - configurable array aggregation limits (maxElements, maxNestedArrayDepth) with inconsistent cleanup handling - was introduced to Netty in June 2026, almost 7 years after this version was released (October 2019). The target version has a much simpler implementation without configurable limits, the releaseAndClea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56818" }, "impact_statement": "not_affected \u2014 Version 4.1.43.Final is not affected by CVE-2026-56818. The vulnerable code pattern - configurable array aggregation limits (maxElements, maxNestedArrayDepth) with inconsistent cleanup handling - was introduced to Netty in June 2026, almost 7 years after this version was released (October 2019). The target version has a much simpler implementation without configurable limits, the releaseAndClea..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.43.Final-tuxcare.1 of io.netty:netty-example. not_affected \u2014 Netty 4.1.43.Final is NOT affected by CVE-2026-59919. The vulnerability requires HAProxyMessageEncoder.encodeV1() to write AF_UNIX addresses to V1 text protocol format without CRLF validation. However, version 4.1.43.Final does NOT contain HAProxyMessageEncoder - it is a decoder-only implementation with no encoding capability. While the underlying data flaw exists (checkAddress() performs no CR...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Netty 4.1.43.Final is NOT affected by CVE-2026-59919. The vulnerability requires HAProxyMessageEncoder.encodeV1() to write AF_UNIX addresses to V1 text protocol format without CRLF validation. However, version 4.1.43.Final does NOT contain HAProxyMessageEncoder - it is a decoder-only implementation with no encoding capability. While the underlying data flaw exists (checkAddress() performs no CR..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.43.Final-tuxcare.1 of io.netty:netty-example. Netty 4.1.43.Final is not affected by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic ClientHello fragment aggregation) was introduced in version 4.1.44+ (February 2020), approximately 3.5 months AFTER the 4.1.43.Final release (October 2019). The target version uses AbstractSniHandler which does not implement multi-record ClientHello aggregation and therefore cannot exhibit the quadratic re-copying behavior described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Netty 4.1.43.Final is not affected by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic ClientHello fragment aggregation) was introduced in version 4.1.44+ (February 2020), approximately 3.5 months AFTER the 4.1.43.Final release (October 2019). The target version uses AbstractSniHandler which does not implement multi-record ClientHello aggregation and therefore cannot exhibit the quadratic re-copying behavior described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-example@4.1.43.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.43.Final-tuxcare.1 of io.netty:netty-example." } ] }