{
  "@id": "urn:uuid:d4446a40-3ce0-4855-bf11-c6b8ecf54bee",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:56:44.311599+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T08:49:19.074609+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 does not affect version 4.1.107.Final-tuxcare.2 of io.netty:netty-codec-haproxy. not_affected \u2014 CVE-2022-41881 is not present in Netty 4.1.107.Final. The upstream fix (commit cd91cf3c99) that prevents stack overflow from deeply nested HAProxy TLV structures was already included in the upstream 4.1.107.Final release before TuxCare onboarded it. The fix adds a MAX_NESTING_LEVEL constant (128) and enforces this limit in the readNextTLV method, preventing unbounded recursion. The vulnerable p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41881 is not present in Netty 4.1.107.Final. The upstream fix (commit cd91cf3c99) that prevents stack overflow from deeply nested HAProxy TLV structures was already included in the upstream 4.1.107.Final release before TuxCare onboarded it. The fix adds a MAX_NESTING_LEVEL constant (128) and enforces this limit in the readNextTLV method, preventing unbounded recursion. The vulnerable p..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-59919"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}