{
  "@id": "urn:uuid:dc013752-91f6-43e3-bac8-b15f3ca705b5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T18:51:00.053458+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:51:00.053458+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2022-41881"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:51:00.053458+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:51:00.053458+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Netty 4.1.46.Final is not affected by CVE-2026-59919. While the insufficient AF_UNIX address validation exists (HAProxyMessage.checkAddress() line 410 immediately returns without validation), the vulnerable component HAProxyMessageEncoder that serializes these addresses to wire format does not exist in this version. The encoder was added 1.5 months after 4.1.46.Final release (2020-04-16, commit...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.46.Final is not affected by CVE-2026-59919. While the insufficient AF_UNIX address validation exists (HAProxyMessage.checkAddress() line 410 immediately returns without validation), the vulnerable component HAProxyMessageEncoder that serializes these addresses to wire format does not exist in this version. The encoder was added 1.5 months after 4.1.46.Final release (2020-04-16, commit..."
    }
  ]
}