{
  "@id": "urn:uuid:223639bb-a2d9-4224-8936-eabb2a2e73ce",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:20:07.636772+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-all@4.2.12.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-all@4.2.12.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:20:07.636772+00:00",
      "status_notes": "Vulnerability CVE-2014-0193 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-all. not_affected \u2014 CVE-2014-0193 affects Netty's WebSocket frame decoder, which previously accumulated continuation frame text without limit, enabling memory exhaustion attacks. The target Netty 4.2.12.Final already contains the upstream fix (commit 93fab1d5a3, April 2014 by Norman Maurer) that was shipped in the base release TuxCare onboarded. The vulnerable UTF8Output class with unbounded StringBuilder accumula...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0193"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0193 affects Netty's WebSocket frame decoder, which previously accumulated continuation frame text without limit, enabling memory exhaustion attacks. The target Netty 4.2.12.Final already contains the upstream fix (commit 93fab1d5a3, April 2014 by Norman Maurer) that was shipped in the base release TuxCare onboarded. The vulnerable UTF8Output class with unbounded StringBuilder accumula..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-all@4.2.12.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-all@4.2.12.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:20:07.636772+00:00",
      "status_notes": "Vulnerability CVE-2019-16869 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-all. Target version 4.2.12.Final is not affected by CVE-2019-16869. The vulnerability (mishandling whitespace before colon in HTTP headers leading to request smuggling) was fixed in upstream Netty commit 39cafcb05c by Norman Maurer on September 20, 2019. This fix was included in Netty 4.1.42.Final (released September 25, 2019) and all subsequent versions. The target version 4.2.12.Final (released March 24, 2026) is approximately 6.5 years newer and already contains the upstream fix in its base release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Beta1, < 4.1.42.Final), NVD (< 4.1.42), Snyk (< 4.1.42.Final; < 4.1.42.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16869"
      },
      "impact_statement": "Target version 4.2.12.Final is not affected by CVE-2019-16869. The vulnerability (mishandling whitespace before colon in HTTP headers leading to request smuggling) was fixed in upstream Netty commit 39cafcb05c by Norman Maurer on September 20, 2019. This fix was included in Netty 4.1.42.Final (released September 25, 2019) and all subsequent versions. The target version 4.2.12.Final (released March 24, 2026) is approximately 6.5 years newer and already contains the upstream fix in its base release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Beta1, < 4.1.42.Final), NVD (< 4.1.42), Snyk (< 4.1.42.Final; < 4.1.42.Final)."
    }
  ]
}