{
  "@id": "urn:uuid:43d719a5-afc6-4035-9e5d-7bc9de332a6b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T08:46:00.114957+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 does not affect version 4.1.130.Final-tuxcare.4 of io.netty:netty-codec-haproxy. not_affected \u2014 CVE-2022-41881 is NOT present in target version 4.1.130.Final. The vulnerability (StackOverflowError from unbounded recursion when parsing nested HAProxy TLVs) was fixed by upstream Netty in version 4.1.86.Final (commit cd91cf3c99 by Norman Maurer). This fix was already included in the upstream 4.1.130.Final release that TuxCare onboarded, so the vulnerable pattern does not exist in the target....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41881 is NOT present in target version 4.1.130.Final. The vulnerability (StackOverflowError from unbounded recursion when parsing nested HAProxy TLVs) was fixed by upstream Netty in version 4.1.86.Final (commit cd91cf3c99 by Norman Maurer). This fix was already included in the upstream 4.1.130.Final release that TuxCare onboarded, so the vulnerable pattern does not exist in the target...."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-59919"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.130.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}