{
  "@id": "urn:uuid:2e44627c-ac9b-4a52-b929-724fc68e3607",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T08:52:10.620905+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 does not affect version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-haproxy. not_affected \u2014 The target version 4.1.122.Final is not affected by CVE-2022-41881. The fix for the infinite recursion vulnerability in HAProxy TLV parsing was already present in the upstream Netty release 4.1.122.Final that was onboarded to the TuxCare repository. The fix (commit cd91cf3c99 by Norman Maurer) adds a MAX_NESTING_LEVEL limit of 128 and checks it before recursion in readNextTLV(), preventing Stac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "impact_statement": "not_affected \u2014 The target version 4.1.122.Final is not affected by CVE-2022-41881. The fix for the infinite recursion vulnerability in HAProxy TLV parsing was already present in the upstream Netty release 4.1.122.Final that was onboarded to the TuxCare repository. The fix (commit cd91cf3c99 by Norman Maurer) adds a MAX_NESTING_LEVEL limit of 128 and checks it before recursion in readNextTLV(), preventing Stac..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-59919"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.122.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}