{ "@id": "urn:uuid:e31da08f-8484-487e-8c7e-baa5b3509e2d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-27T07:20:10.283381+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-21409" }, "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:59.275101+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:20:10.283381+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Version 4.1.23.Final does not contain the vulnerable code. CVE-2023-34462 affects the fragmented ClientHello handshake handling mechanism that allocates buffers up to 16MB based on the handshakeLength field. This vulnerable code was introduced in commit 29c471ec52 (November 29, 2019) and fixed in commit 535da17e45 (June 20, 2023). Target version 4.1.23.Final was released April 4, 2018\u20141 year an...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Version 4.1.23.Final does not contain the vulnerable code. CVE-2023-34462 affects the fragmented ClientHello handshake handling mechanism that allocates buffers up to 16MB based on the handshakeLength field. This vulnerable code was introduced in commit 29c471ec52 (November 29, 2019) and fixed in commit 535da17e45 (June 20, 2023). Target version 4.1.23.Final was released April 4, 2018\u20141 year an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-haproxy 4.1.23.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:59.275101+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:20:10.283381+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:59.275101+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2025-59419 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-59419" }, "action_statement": "Vulnerability CVE-2025-59419 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:59.275101+00:00", "status_notes": "Vulnerability CVE-2026-42579 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42579" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Target version 4.1.23.Final is NOT AFFECTED by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow protection via NumberFormatException. The vulnerable code pattern (manual hex parsing with int accumulation: result *= 16; result += digit; if (result < 0)) does not exist in this version. The vulnerability was introduced in a later archi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Target version 4.1.23.Final is NOT AFFECTED by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow protection via NumberFormatException. The vulnerable code pattern (manual hex parsing with int accumulation: result *= 16; result += digit; if (result < 0)) does not exist in this version. The vulnerability was introduced in a later archi..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy. Version 4.1.23.Final is not affected by CVE-2026-42587. The vulnerability describes maxAllocation parameter bypass for brotli/zstd/snappy decompression, but this version predates both the maxAllocation feature and brotli/zstd decoder support. The affected code path does not exist: (1) BrotliDecoder and ZstdDecoder classes are absent, (2) SnappyFrameDecoder exists but is not integrated into HTTP decompression, (3) HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip/deflate encodings, (4) no maxAllocation parameter exists in any decompressor constructor. The CVE describes a regression in newer versions that added these features; 4.1.23.Final is in a pre-feature state.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Version 4.1.23.Final is not affected by CVE-2026-42587. The vulnerability describes maxAllocation parameter bypass for brotli/zstd/snappy decompression, but this version predates both the maxAllocation feature and brotli/zstd decoder support. The affected code path does not exist: (1) BrotliDecoder and ZstdDecoder classes are absent, (2) SnappyFrameDecoder exists but is not integrated into HTTP decompression, (3) HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip/deflate encodings, (4) no maxAllocation parameter exists in any decompressor constructor. The CVE describes a regression in newer versions that added these features; 4.1.23.Final is in a pre-feature state." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Target version 4.1.23.Final (released April 2018) does not implement MQTT 5 protocol. The vulnerability concerns MQTT 5's Properties section parsing, which was introduced to Netty on 2020-08-31 (commit fb4a57826b), approximately 2.5 years after this version was released. The target only supports MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections in their protocol specifications. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 Target version 4.1.23.Final (released April 2018) does not implement MQTT 5 protocol. The vulnerability concerns MQTT 5's Properties section parsing, which was introduced to Netty on 2020-08-31 (commit fb4a57826b), approximately 2.5 years after this version was released. The target only supports MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections in their protocol specifications. The..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44249" }, "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44893" }, "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy. Target version 4.1.23.Final (April 2018) does not contain the vulnerable code. CVE-2026-45416 affects SslClientHelloHandler, which was introduced in Netty 4.1.46+ (February 2020), nearly 2 years after this release. The target uses AbstractSniHandler with a completely different architecture: it extends ByteToMessageDecoder (not SslClientHelloHandler), processes ClientHello in-place without buffer allocation, and handles only single TLS records (max 64KB each). The vulnerable pattern\u2014eagerly allocating ctx.alloc().buffer(handshakeLength) for multi-record ClientHello messages up to 16MB\u2014does not exist in this version. Type A2 analysis: Input (ClientHello) IS received, but the chain to Goal (unbounded allocations) is absent because the allocation step does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Target version 4.1.23.Final (April 2018) does not contain the vulnerable code. CVE-2026-45416 affects SslClientHelloHandler, which was introduced in Netty 4.1.46+ (February 2020), nearly 2 years after this release. The target uses AbstractSniHandler with a completely different architecture: it extends ByteToMessageDecoder (not SslClientHelloHandler), processes ClientHello in-place without buffer allocation, and handles only single TLS records (max 64KB each). The vulnerable pattern\u2014eagerly allocating ctx.alloc().buffer(handshakeLength) for multi-record ClientHello messages up to 16MB\u2014does not exist in this version. Type A2 analysis: Input (ClientHello) IS received, but the chain to Goal (unbounded allocations) is absent because the allocation step does not exist." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-45674 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-45674" }, "action_statement": "Vulnerability CVE-2026-45674 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:20:10.283381+00:00", "status_notes": "Vulnerability CVE-2026-46340 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-46340" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-48059" }, "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-56746 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Target version 4.1.23.Final (released April 4, 2018) predates the introduction of the vulnerable code by 7 days. The vulnerability exists in getForOrigin() method with OR logic introduced on April 11, 2018. This target uses validateOrigin() with correct AND logic that blocks Origin: null bypass attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56746" }, "impact_statement": "not_affected \u2014 Target version 4.1.23.Final (released April 4, 2018) predates the introduction of the vulnerable code by 7 days. The vulnerability exists in getForOrigin() method with OR logic introduced on April 11, 2018. This target uses validateOrigin() with correct AND logic that blocks Origin: null bypass attacks." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-56818 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56818" }, "action_statement": "Vulnerability CVE-2026-56818 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Target version 4.1.23.Final is not affected by CVE-2026-59919. The vulnerability requires HAProxyMessageEncoder to serialize HAProxyMessage objects to HAProxy V1 protocol format, enabling CRLF injection when AF_UNIX addresses contain line-break or delimiter characters. However, HAProxyMessageEncoder was not introduced until 4.1.49.Final (April 2020), 26 versions and 2 years after this target (A...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Target version 4.1.23.Final is not affected by CVE-2026-59919. The vulnerability requires HAProxyMessageEncoder to serialize HAProxyMessage objects to HAProxy V1 protocol format, enabling CRLF injection when AF_UNIX addresses contain line-break or delimiter characters. However, HAProxyMessageEncoder was not introduced until 4.1.49.Final (April 2020), 26 versions and 2 years after this target (A..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.23.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:19:40.187123+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-codec-haproxy." } ] }