{
  "@id": "urn:uuid:56425494-ca24-4a51-abe3-9fdd8aee6593",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:51:00.040518+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.43.Final-tuxcare.3 of io.netty:netty-codec-mqtt. not_affected \u2014 Target version 4.1.43.Final does not support MQTT 5 and lacks the Properties parsing code described in CVE-2026-44248. The vulnerability is specific to MQTT 5's unbounded Properties section in variable headers, causing resource exhaustion through repeated parsing by ReplayingDecoder. This version only supports MQTT 3.1 and MQTT 3.1.1, which use fixed-structure variable headers without Propertie...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44248"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.43.Final does not support MQTT 5 and lacks the Properties parsing code described in CVE-2026-44248. The vulnerability is specific to MQTT 5's unbounded Properties section in variable headers, causing resource exhaustion through repeated parsing by ReplayingDecoder. This version only supports MQTT 3.1 and MQTT 3.1.1, which use fixed-structure variable headers without Propertie..."
    }
  ]
}