{
  "@id": "urn:uuid:590ec278-f9ad-404c-9bd2-68537905b2ae",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "action_statement": "Vulnerability CVE-2022-41881 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-13T12:23:00.134646+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      },
      "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-13T12:23:00.134646+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      },
      "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.48.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Netty 4.1.48.Final is not affected by CVE-2026-59919. The vulnerable component HAProxyMessageEncoder does not exist in this version. The encoder class was added later on April 16, 2020 (one month after 4.1.48.Final release on March 17, 2020). While HAProxyMessage in this version accepts AF_UNIX addresses without CRLF validation, there is no code path that encodes these addresses into HAProxy V1...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.48.Final is not affected by CVE-2026-59919. The vulnerable component HAProxyMessageEncoder does not exist in this version. The encoder class was added later on April 16, 2020 (one month after 4.1.48.Final release on March 17, 2020). While HAProxyMessage in this version accepts AF_UNIX addresses without CRLF validation, there is no code path that encodes these addresses into HAProxy V1..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.48.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.1 of io.netty:netty-codec-haproxy."
    }
  ]
}