{
  "@id": "urn:uuid:b5696f70-2665-4cff-b01d-0d5bb690f7cd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T13:11:20.672019+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2026-45673"
      },
      "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2026-45674 does not affect version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns. Version 4.1.24.Final is not affected by CVE-2026-45674 because the vulnerable component (DnsCnameCache) does not exist in this version. The CVE targets DNS cache poisoning via unvalidated CNAME records being cached persistently. While 4.1.24 does process CNAME records in the buildAliasMap method without bailiwick validation, it only creates a transient HashMap scoped to a single resolution\u2014there is no persistent CNAME cache to poison. The DnsCnameCache feature and associated caching logic were introduced in later versions (4.1.52+), which is why those versions received CVE-2026-45674 backports while 4.1.24 did not.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45674"
      },
      "impact_statement": "Version 4.1.24.Final is not affected by CVE-2026-45674 because the vulnerable component (DnsCnameCache) does not exist in this version. The CVE targets DNS cache poisoning via unvalidated CNAME records being cached persistently. While 4.1.24 does process CNAME records in the buildAliasMap method without bailiwick validation, it only creates a transient HashMap scoped to a single resolution\u2014there is no persistent CNAME cache to poison. The DnsCnameCache feature and associated caching logic were introduced in later versions (4.1.52+), which is why those versions received CVE-2026-45674 backports while 4.1.24 did not."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "CVE-2026-47691"
      },
      "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-resolver-dns@4.1.24.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:11:20.672019+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.24.Final-tuxcare.2 of io.netty:netty-resolver-dns."
    }
  ]
}