{
  "@id": "urn:uuid:1f387ffc-b46f-4ef8-ae67-f2e2b06df7f9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T08:46:00.114957+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 does not affect version 4.1.94.Final-tuxcare.2 of io.netty:netty-codec-haproxy. not_affected \u2014 CVE-2022-41881 (HAProxy TLV nesting stack overflow) is NOT present in Netty 4.1.94.Final. The fix was already included in the upstream release before TuxCare onboarded it. The target contains the complete upstream fix: MAX_NESTING_LEVEL constant, nesting depth tracking in readNextTLV(), and the guard that throws HAProxyProtocolException when nesting exceeds 128 levels. Fix commit cd91cf3c99 aut...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41881 (HAProxy TLV nesting stack overflow) is NOT present in Netty 4.1.94.Final. The fix was already included in the upstream release before TuxCare onboarded it. The target contains the complete upstream fix: MAX_NESTING_LEVEL constant, nesting depth tracking in readNextTLV(), and the guard that throws HAProxyProtocolException when nesting exceeds 128 levels. Fix commit cd91cf3c99 aut..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-59919"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}