{
  "@id": "urn:uuid:f64c8ae5-988a-42df-b3b5-95801d6fdd4c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-26T15:29:41.341271+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2019-16869 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2019-16869"
      },
      "action_statement": "Vulnerability CVE-2019-16869 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2019-20444"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "action_statement": "Vulnerability CVE-2021-21290 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. Target version 4.0.56.Final is NOT AFFECTED by CVE-2021-37136. The vulnerable Bzip2Decoder component and all related Bzip2 decompression classes do not exist in Netty 4.0.x series. Bzip2 support was first introduced in Netty 4.1.0.Beta1 (commit f9021a6061), which is not part of the 4.0.x lineage. The target version predates the introduction of Bzip2 functionality and therefore cannot process Bzip2 compressed data or be exploited via this vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "impact_statement": "Target version 4.0.56.Final is NOT AFFECTED by CVE-2021-37136. The vulnerable Bzip2Decoder component and all related Bzip2 decompression classes do not exist in Netty 4.0.x series. Bzip2 support was first introduced in Netty 4.1.0.Beta1 (commit f9021a6061), which is not part of the 4.0.x lineage. The target version predates the introduction of Bzip2 functionality and therefore cannot process Bzip2 compressed data or be exploited via this vulnerability."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "action_statement": "Vulnerability CVE-2021-43797 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "action_statement": "Vulnerability CVE-2022-41881 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Netty version 4.0.56.Final is NOT affected by CVE-2023-34462. The vulnerability requires code to read a 3-byte handshake length field from TLS ClientHello messages and allocate/accumulate buffers based on that value (up to 16MB). Version 4.0.56.Final uses a completely different architecture: it lacks the SslClientHelloHandler class mentioned in the CVE, does not read the handshake length field,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Netty version 4.0.56.Final is NOT affected by CVE-2023-34462. The vulnerability requires code to read a 3-byte handshake length field from TLS ClientHello messages and allocate/accumulate buffers based on that value (up to 16MB). Version 4.0.56.Final uses a completely different architecture: it lacks the SslClientHelloHandler class mentioned in the CVE, does not read the handshake length field,..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "action_statement": "Vulnerability CVE-2024-29025 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "action_statement": "Vulnerability CVE-2025-25193 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Version 4.0.56.Final is not affected by CVE-2025-58057. The vulnerability pattern involves accumulating MULTIPLE byte buffers during a single decompression operation. BrotliDecoder (the primary vulnerable component) does not exist in this version. The ZLib decoders present (JdkZlibDecoder, JZlibDecoder) allocate a SINGLE buffer per decode() call and expand it as needed, rather than accumulating...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "impact_statement": "not_affected \u2014 Version 4.0.56.Final is not affected by CVE-2025-58057. The vulnerability pattern involves accumulating MULTIPLE byte buffers during a single decompression operation. BrotliDecoder (the primary vulnerable component) does not exist in this version. The ZLib decoders present (JdkZlibDecoder, JZlibDecoder) allocate a SINGLE buffer per decode() call and expand it as needed, rather than accumulating..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Target version 4.0.56.Final is NOT affected by CVE-2026-42580. The vulnerability requires manual byte[] chunk size accumulation with inadequate overflow check (if result < 0), a pattern introduced in Netty 4.1.x. The target uses Java's Integer.parseInt(hex, 16) which has JLS-specified overflow protection, throwing NumberFormatException for values exceeding Integer.MAX_VALUE. The CVE's attack pa...",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Target version 4.0.56.Final is NOT affected by CVE-2026-42580. The vulnerability requires manual byte[] chunk size accumulation with inadequate overflow check (if result < 0), a pattern introduced in Netty 4.1.x. The target uses Java's Integer.parseInt(hex, 16) which has JLS-specified overflow protection, throwing NumberFormatException for values exceeding Integer.MAX_VALUE. The CVE's attack pa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. Netty version 4.0.56.Final is not affected by CVE-2026-42583. The vulnerable component (Lz4FrameDecoder) does not exist in this version. LZ4 codec support was introduced in Netty 4.1.0.Beta2 and was never added to the 4.0 release line. No LZ4-related code, classes, or dependencies are present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "impact_statement": "Netty version 4.0.56.Final is not affected by CVE-2026-42583. The vulnerable component (Lz4FrameDecoder) does not exist in this version. LZ4 codec support was introduced in Netty 4.1.0.Beta2 and was never added to the 4.0 release line. No LZ4-related code, classes, or dependencies are present in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. CVE-2026-42587 describes a bypass vulnerability in Netty 4.1.x where the maxAllocation decompression limit is ignored for Brotli/Zstd/Snappy encodings, allowing attackers to bypass configured protection by changing the Content-Encoding header. Target version 4.0.56.Final (released Feb 2018) predates both the maxAllocation feature (added May 2025 in 4.1.x) and Brotli/Zstd/Snappy decoder support (added 2021+ in 4.1.x). The specific vulnerability pattern - bypassing a configured limit via alternative encodings - cannot manifest when neither the protection mechanism nor the bypass vectors exist. The CVE's locked Goal \"decompression output exceeds the configured maxAllocation limit\" is meaningless in 4.0.56.Final where no maxAllocation can be configured.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "CVE-2026-42587 describes a bypass vulnerability in Netty 4.1.x where the maxAllocation decompression limit is ignored for Brotli/Zstd/Snappy encodings, allowing attackers to bypass configured protection by changing the Content-Encoding header. Target version 4.0.56.Final (released Feb 2018) predates both the maxAllocation feature (added May 2025 in 4.1.x) and Brotli/Zstd/Snappy decoder support (added 2021+ in 4.1.x). The specific vulnerability pattern - bypassing a configured limit via alternative encodings - cannot manifest when neither the protection mechanism nor the bypass vectors exist. The CVE's locked Goal \"decompression output exceeds the configured maxAllocation limit\" is meaningless in 4.0.56.Final where no maxAllocation can be configured."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      },
      "action_statement": "Vulnerability CVE-2026-44893 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. Version 4.0.56.Final is not affected by CVE-2026-45416. The vulnerable classes SslClientHelloHandler and AbstractSniHandler do not exist in this version - they were introduced in Netty 4.1.x. The 4.0.x SniHandler uses a fundamentally different architecture that parses ClientHello inline from the channel's input buffer without eager allocation based on protocol length fields. The vulnerability pattern (reading 24-bit handshake length and immediately allocating ctx.alloc().buffer(handshakeLength) before data arrives) does not exist in 4.0.56.Final.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Version 4.0.56.Final is not affected by CVE-2026-45416. The vulnerable classes SslClientHelloHandler and AbstractSniHandler do not exist in this version - they were introduced in Netty 4.1.x. The 4.0.x SniHandler uses a fundamentally different architecture that parses ClientHello inline from the channel's input buffer without eager allocation based on protocol length fields. The vulnerability pattern (reading 24-bit handshake length and immediately allocating ctx.alloc().buffer(handshakeLength) before data arrives) does not exist in 4.0.56.Final."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-45536 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-45536"
      },
      "action_statement": "Vulnerability CVE-2026-45536 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-46340 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-46340"
      },
      "action_statement": "Vulnerability CVE-2026-46340 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      },
      "action_statement": "Vulnerability CVE-2026-48059 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "action_statement": "Vulnerability CVE-2026-55851 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Target version 4.0.56.Final does not have the CVE-2026-56746 vulnerability. The CVE describes a logical operator error in Netty 4.1.x versions where the getForOrigin() method uses OR logic (||) instead of AND (&&), allowing Origin: null requests to bypass short-circuit protection even when isNullOriginAllowed is false. However, 4.0.56.Final uses a different architecture with a validateOrigin() ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "impact_statement": "not_affected \u2014 Target version 4.0.56.Final does not have the CVE-2026-56746 vulnerability. The CVE describes a logical operator error in Netty 4.1.x versions where the getForOrigin() method uses OR logic (||) instead of AND (&&), allowing Origin: null requests to bypass short-circuit protection even when isNullOriginAllowed is false. However, 4.0.56.Final uses a different architecture with a validateOrigin() ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. Version 4.0.56.Final does not contain Bzip2 decompression functionality. The Bzip2Decoder and its vulnerable RLE state machine were added to Netty in version 4.1.0.Beta1 (June 2014), which is in the 4.1.x series. Version 4.0.56.Final is from the older 4.0.x maintenance branch and never received Bzip2 support. The compression package contains only Zlib and Snappy codecs, with a TODO comment confirming bzip2 was planned but not implemented.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "impact_statement": "Version 4.0.56.Final does not contain Bzip2 decompression functionality. The Bzip2Decoder and its vulnerable RLE state machine were added to Netty in version 4.1.0.Beta1 (June 2014), which is in the 4.1.x series. Version 4.0.56.Final is from the older 4.0.x maintenance branch and never received Bzip2 support. The compression package contains only Zlib and Snappy codecs, with a TODO comment confirming bzip2 was planned but not implemented."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59902 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-59902"
      },
      "action_statement": "Vulnerability CVE-2026-59902 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Netty version 4.0.56.Final is not affected by CVE-2026-59919 (HAProxy PROXY Protocol CRLF Injection). The vulnerability requires HAProxyMessageEncoder.encodeV1() to write AF_UNIX addresses to V1 text-based protocol output without CRLF validation. However, HAProxyMessageEncoder was introduced in version ~5.0.0.Alpha1 and does not exist in this version. Version 4.0.56.Final contains only HAProxy ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "impact_statement": "not_affected \u2014 Netty version 4.0.56.Final is not affected by CVE-2026-59919 (HAProxy PROXY Protocol CRLF Injection). The vulnerability requires HAProxyMessageEncoder.encodeV1() to write AF_UNIX addresses to V1 text-based protocol output without CRLF validation. However, HAProxyMessageEncoder was introduced in version ~5.0.0.Alpha1 and does not exist in this version. Version 4.0.56.Final contains only HAProxy ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-buffer@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-buffer. Netty 4.0.56.Final (released 2018-02-05) pre-dates the introduction of the vulnerable fragmented ClientHello aggregation code by almost 2 years. The CVE-2026-75596 vulnerability exists in SslClientHelloHandler's handshakeBuffer.clear() + writeBytes() pattern, which causes quadratic CPU consumption. This class and mechanism were introduced in 2019-2020 for the 4.1.x branch. Version 4.0.56.Final uses a simpler SniHandler architecture that waits for complete TLS records and parses inline without any aggregation buffer, so the vulnerable code is not present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "impact_statement": "Netty 4.0.56.Final (released 2018-02-05) pre-dates the introduction of the vulnerable fragmented ClientHello aggregation code by almost 2 years. The CVE-2026-75596 vulnerability exists in SslClientHelloHandler's handshakeBuffer.clear() + writeBytes() pattern, which causes quadratic CPU consumption. This class and mechanism were introduced in 2019-2020 for the 4.1.x branch. Version 4.0.56.Final uses a simpler SniHandler architecture that waits for complete TLS records and parses inline without any aggregation buffer, so the vulnerable code is not present in this version."
    }
  ]
}