{ "@id": "urn:uuid:3c79c686-a77d-4fe8-947a-8ff89fe0ccbb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-27T07:06:00.167611+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-21409" }, "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Version 4.1.38.Final does not contain the vulnerable code path. The vulnerability exists in SslClientHelloHandler (introduced Feb 2020), which allocates a buffer based on a 3-byte handshake length field (up to 16MB). Version 4.1.38.Final (released July 2019) uses a different architecture where AbstractSniHandler parses ClientHello inline without separate buffer allocation, reading only 2-byte T...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Version 4.1.38.Final does not contain the vulnerable code path. The vulnerability exists in SslClientHelloHandler (introduced Feb 2020), which allocates a buffer based on a 3-byte handshake length field (up to 16MB). Version 4.1.38.Final (released July 2019) uses a different architecture where AbstractSniHandler parses ClientHello inline without separate buffer allocation, reading only 2-byte T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-haproxy 4.1.38.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Version 4.1.38.Final is not affected by CVE-2025-25193 because the vulnerable component (BoundedInputStream) does not exist in this version. BoundedInputStream was only introduced in upstream Netty 4.1.115 (November 2024) as a fix for CVE-2024-47535. CVE-2025-25193 is specifically about a bug IN BoundedInputStream where null bytes bypass the input limit. Since version 4.1.38.Final predates Boun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Version 4.1.38.Final is not affected by CVE-2025-25193 because the vulnerable component (BoundedInputStream) does not exist in this version. BoundedInputStream was only introduced in upstream Netty 4.1.115 (November 2024) as a fix for CVE-2024-47535. CVE-2025-25193 is specifically about a bug IN BoundedInputStream where null bytes bypass the input limit. Since version 4.1.38.Final predates Boun..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2025-59419 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-59419" }, "action_statement": "Vulnerability CVE-2025-59419 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2026-42579 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42579" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Netty 4.1.38.Final is not affected by CVE-2026-42580. This version uses Java's Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow checking and throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerable manual parsing implementation with inadequate overflow checks only exists in versions \u2265 4.1.94, where Netty refactored from String-based parsin...", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Netty 4.1.38.Final is not affected by CVE-2026-42580. This version uses Java's Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow checking and throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerable manual parsing implementation with inadequate overflow checks only exists in versions \u2265 4.1.94, where Netty refactored from String-based parsin..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy. CVE-2026-42587 describes a vulnerability where the maxAllocation parameter (introduced to prevent decompression bomb attacks) is silently ignored for Brotli, Zstd, and Snappy encodings, allowing attackers to bypass the configured memory limit. Version 4.1.38.Final is NOT AFFECTED because the maxAllocation feature does not exist in this version at all. The vulnerable code pattern (incomplete maxAllocation enforcement for non-gzip encodings) cannot exist when maxAllocation itself was not introduced until May 2025 (commit a155024263), well after the 4.1.38.Final release. This version only supports gzip/deflate decompression with no configurable memory limits. The attack chain is broken at the \"configured limit\" step - there is no configured limit to bypass.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "CVE-2026-42587 describes a vulnerability where the maxAllocation parameter (introduced to prevent decompression bomb attacks) is silently ignored for Brotli, Zstd, and Snappy encodings, allowing attackers to bypass the configured memory limit. Version 4.1.38.Final is NOT AFFECTED because the maxAllocation feature does not exist in this version at all. The vulnerable code pattern (incomplete maxAllocation enforcement for non-gzip encodings) cannot exist when maxAllocation itself was not introduced until May 2025 (commit a155024263), well after the 4.1.38.Final release. This version only supports gzip/deflate decompression with no configurable memory limits. The attack chain is broken at the \"configured limit\" step - there is no configured limit to bypass." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Netty 4.1.38.Final is not affected by CVE-2026-44248. This CVE targets MQTT 5 Properties section parsing that occurs before message size validation, causing resource exhaustion via ReplayingDecoder's repeated re-parsing. However, this version only supports MQTT 3.1 and 3.1.1 (verified in MqttVersion.java lines 26-27). MQTT 5 support, including the vulnerable Properties parsing code, was added i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 Netty 4.1.38.Final is not affected by CVE-2026-44248. This CVE targets MQTT 5 Properties section parsing that occurs before message size validation, causing resource exhaustion via ReplayingDecoder's repeated re-parsing. However, this version only supports MQTT 3.1 and 3.1.1 (verified in MqttVersion.java lines 26-27). MQTT 5 support, including the vulnerable Properties parsing code, was added i..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44249" }, "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-44893" }, "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy. Version 4.1.38.Final is NOT AFFECTED by CVE-2026-45416. The vulnerable class SslClientHelloHandler does not exist in this version - it was introduced 6+ months later in February 2020 (commit 77effdc4da), while 4.1.38.Final was released in July 2019. This version uses AbstractSniHandler with a fundamentally different architecture: it processes TLS ClientHello inline without the multi-record buffering mechanism that contains the vulnerability. The vulnerable pattern (reading 24-bit handshake length and eagerly allocating ctx.alloc().buffer(handshakeLength) up to 16MB) is absent. AbstractSniHandler in 4.1.38.Final only reads the 16-bit TLS record length (max ~16KB per RFC) and performs no buffer allocations in its decode() method. The INPUT (TLS ClientHello) is received, but no code path reaches the GOAL (excessive memory allocation based on attacker-controlled handshake length). This satisfies Rule 5 Type A2: chain absent due to missing SslClientHelloHandler buffering mechanism.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.38.Final is NOT AFFECTED by CVE-2026-45416. The vulnerable class SslClientHelloHandler does not exist in this version - it was introduced 6+ months later in February 2020 (commit 77effdc4da), while 4.1.38.Final was released in July 2019. This version uses AbstractSniHandler with a fundamentally different architecture: it processes TLS ClientHello inline without the multi-record buffering mechanism that contains the vulnerability. The vulnerable pattern (reading 24-bit handshake length and eagerly allocating ctx.alloc().buffer(handshakeLength) up to 16MB) is absent. AbstractSniHandler in 4.1.38.Final only reads the 16-bit TLS record length (max ~16KB per RFC) and performs no buffer allocations in its decode() method. The INPUT (TLS ClientHello) is received, but no code path reaches the GOAL (excessive memory allocation based on attacker-controlled handshake length). This satisfies Rule 5 Type A2: chain absent due to missing SslClientHelloHandler buffering mechanism." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-45674 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-45674" }, "action_statement": "Vulnerability CVE-2026-45674 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2026-46340 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-46340" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-48059" }, "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-56818 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56818" }, "action_statement": "Vulnerability CVE-2026-56818 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 Version 4.1.38.Final is NOT affected by CVE-2026-59919. While the target's checkAddress() method lacks CRLF validation for AF_UNIX addresses (data flaw present), the vulnerability cannot be exploited because the required components do not exist: (1) HAProxyMessageEncoder was added later in 4.1.49.Final (commit 9ac005222b, Apr 2020), (2) all HAProxyMessage constructors are private, preventing ex...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Version 4.1.38.Final is NOT affected by CVE-2026-59919. While the target's checkAddress() method lacks CRLF validation for AF_UNIX addresses (data flaw present), the vulnerability cannot be exploited because the required components do not exist: (1) HAProxyMessageEncoder was added later in 4.1.49.Final (commit 9ac005222b, Apr 2020), (2) all HAProxyMessage constructors are private, preventing ex..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy. Version 4.1.38.Final is not affected by CVE-2026-75596. The vulnerability exists in SslClientHelloHandler's quadratic re-aggregation of fragmented ClientHello messages (handshakeBuffer.clear() + writeBytes() pattern causing O(n\u00b2) CPU consumption). This class was introduced on Feb 5, 2020 via PR #9827, approximately 6 months after version 4.1.38.Final was released (July 24, 2019). The target version uses AbstractSniHandler which parses ClientHello directly from the ByteToMessageDecoder cumulation buffer without creating intermediate buffers or performing repeated copying, eliminating the attack path to quadratic CPU exhaustion. No CVE-2026-75596 backports exist for versions older than 4.1.119.Final, confirming that pre-SslClientHelloHandler versions are not vulnerable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Version 4.1.38.Final is not affected by CVE-2026-75596. The vulnerability exists in SslClientHelloHandler's quadratic re-aggregation of fragmented ClientHello messages (handshakeBuffer.clear() + writeBytes() pattern causing O(n\u00b2) CPU consumption). This class was introduced on Feb 5, 2020 via PR #9827, approximately 6 months after version 4.1.38.Final was released (July 24, 2019). The target version uses AbstractSniHandler which parses ClientHello directly from the ByteToMessageDecoder cumulation buffer without creating intermediate buffers or performing repeated copying, eliminating the attack path to quadratic CPU exhaustion. No CVE-2026-75596 backports exist for versions older than 4.1.119.Final, confirming that pre-SslClientHelloHandler versions are not vulnerable." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-haproxy." } ] }