{ "@id": "urn:uuid:7e1a07b4-74ff-466b-a9a1-193a6eef6702", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-26T18:34:00.060063+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2021-21409" }, "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:46:32.051982+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:46:32.051982+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec. not_affected \u2014 Netty 4.1.31.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability requires SslClientHelloHandler, which reads a 3-byte handshake length field (up to 16MB). This class was introduced in February 2020, AFTER version 4.1.31.Final was released. Version 4.1.31.Final only has AbstractSniHandler, which reads 2-byte packet lengths (max 65KB). The architectural code path that enables 16MB-per-conn...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty 4.1.31.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability requires SslClientHelloHandler, which reads a 3-byte handshake length field (up to 16MB). This class was introduced in February 2020, AFTER version 4.1.31.Final was released. Version 4.1.31.Final only has AbstractSniHandler, which reads 2-byte packet lengths (max 65KB). The architectural code path that enables 16MB-per-conn..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec 4.1.31.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:46:32.051982+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:46:32.051982+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:46:32.051982+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2025-59419 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2025-59419" }, "action_statement": "Vulnerability CVE-2025-59419 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:46:32.051982+00:00", "status_notes": "Vulnerability CVE-2026-42579 is fixed in version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-42579" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec. not_affected \u2014 Target version 4.1.31.Final is not affected by CVE-2026-42580. The vulnerability exists in later Netty versions (\u22654.1.128) that use a byte-array-based chunk size parser with manual hex digit accumulation and inadequate overflow checking (only checks `result < 0`). Version 4.1.31.Final uses a String-based parser delegating to Java's Integer.parseInt(hex, 16), which has built-in overflow validati...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Target version 4.1.31.Final is not affected by CVE-2026-42580. The vulnerability exists in later Netty versions (\u22654.1.128) that use a byte-array-based chunk size parser with manual hex digit accumulation and inadequate overflow checking (only checks `result < 0`). Version 4.1.31.Final uses a String-based parser delegating to Java's Integer.parseInt(hex, 16), which has built-in overflow validati..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-42587" }, "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec. not_affected \u2014 Target version 4.1.31.Final implements only MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections. CVE-2026-44248 specifically affects MQTT 5 Properties parsing (introduced in Netty 4.1.52.Final, 21 versions after the target). The vulnerable code pattern (unbounded Properties section parsing via decodeProperties() method) is not present in the target codebase. Type A1 verification: exh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 Target version 4.1.31.Final implements only MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections. CVE-2026-44248 specifically affects MQTT 5 Properties parsing (introduced in Netty 4.1.52.Final, 21 versions after the target). The vulnerable code pattern (unbounded Properties section parsing via decodeProperties() method) is not present in the target codebase. Type A1 verification: exh..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-44249" }, "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-44893" }, "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T18:34:00.060063+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec. Version 4.1.31.Final is not affected by CVE-2026-45416. The vulnerable class SslClientHelloHandler and its eager buffer allocation logic were introduced after this version. The existing AbstractSniHandler implementation in 4.1.31.Final parses ClientHello messages in-place without reading the 24-bit handshake length field or allocating separate buffers based on attacker-controlled size values. The architecture predates the vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.31.Final is not affected by CVE-2026-45416. The vulnerable class SslClientHelloHandler and its eager buffer allocation logic were introduced after this version. The existing AbstractSniHandler implementation in 4.1.31.Final parses ClientHello messages in-place without reading the 24-bit handshake length field or allocating separate buffers based on attacker-controlled size values. The architecture predates the vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-45674 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-45674" }, "action_statement": "Vulnerability CVE-2026-45674 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:46:32.051982+00:00", "status_notes": "Vulnerability CVE-2026-46340 is fixed in version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-46340" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-48059" }, "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-56818 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec. not_affected \u2014 Target version 4.1.31.Final is NOT AFFECTED by CVE-2026-56818. The vulnerability exists in the implementation of configurable array size limits (maxElements and maxNestedArrayDepth) that were added to RedisArrayAggregator in later versions. These configurable limits do not exist in 4.1.31.Final - the code only has a hardcoded Integer.MAX_VALUE check. The CVE describes inconsistent cleanup behav...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56818" }, "impact_statement": "not_affected \u2014 Target version 4.1.31.Final is NOT AFFECTED by CVE-2026-56818. The vulnerability exists in the implementation of configurable array size limits (maxElements and maxNestedArrayDepth) that were added to RedisArrayAggregator in later versions. These configurable limits do not exist in 4.1.31.Final - the code only has a hardcoded Integer.MAX_VALUE check. The CVE describes inconsistent cleanup behav..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec. not_affected \u2014 Netty 4.1.31.Final is NOT AFFECTED by CVE-2026-59919. The vulnerability requires the HAProxyMessageEncoder component to write unvalidated AF_UNIX addresses to HAProxy V1 protocol format. This encoder was added in upstream commit 9ac005222 (#10175) \"Add support for HAProxyMessageEncoder\", which is NOT present in version 4.1.31.Final. The target version only has HAProxyMessageDecoder (decoder-onl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Netty 4.1.31.Final is NOT AFFECTED by CVE-2026-59919. The vulnerability requires the HAProxyMessageEncoder component to write unvalidated AF_UNIX addresses to HAProxy V1 protocol format. This encoder was added in upstream commit 9ac005222 (#10175) \"Add support for HAProxyMessageEncoder\", which is NOT present in version 4.1.31.Final. The target version only has HAProxyMessageDecoder (decoder-onl..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T18:34:00.060063+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec. Target version 4.1.31.Final (Nov 2018) predates the introduction of SslClientHelloHandler.java (Feb 2020) which contains the vulnerable fragment aggregation code. The target uses AbstractSniHandler.java instead, which requires the entire ClientHello in a single TLS record and does not perform multi-record fragment aggregation, making the quadratic CPU vulnerability unreachable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Target version 4.1.31.Final (Nov 2018) predates the introduction of SslClientHelloHandler.java (Feb 2020) which contains the vulnerable fragment aggregation code. The target uses AbstractSniHandler.java instead, which requires the entire ClientHello in a single TLS record and does not perform multi-record fragment aggregation, making the quadratic CPU vulnerability unreachable." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-codec." } ] }