{
  "@id": "urn:uuid:bf327c86-cfdc-4a8b-b2a7-c768a0a0e608",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T22:13:21.712110+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-all@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-all@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2014-0193 does not affect version 4.1.76.Final-tuxcare.2 of io.netty:netty-all. not_affected \u2014 CVE-2014-0193 does not affect Netty 4.1.76.Final. The vulnerability involved unbounded memory accumulation in WebSocket08FrameDecoder when processing fragmented text frames. The decoder accumulated all continuation frame text into a StringBuilder without size limits, enabling DoS via OOME. The fix (commit 93fab1d5a3 by Norman Maurer, April 2014) removed the aggregatedText field from Continuatio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0193"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0193 does not affect Netty 4.1.76.Final. The vulnerability involved unbounded memory accumulation in WebSocket08FrameDecoder when processing fragmented text frames. The decoder accumulated all continuation frame text into a StringBuilder without size limits, enabling DoS via OOME. The fix (commit 93fab1d5a3 by Norman Maurer, April 2014) removed the aggregatedText field from Continuatio..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-all@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-all@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2019-16869 does not affect version 4.1.76.Final-tuxcare.2 of io.netty:netty-all. CVE-2019-16869 affects Netty before 4.1.42.Final. The target version is 4.1.76.Final, which already contains the upstream fix (commit 39cafcb05c by Norman Maurer, Sep 2019). The fix was part of the upstream release when TuxCare onboarded this version. The vulnerable pattern (unconditional whitespace acceptance before colon) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Beta1, < 4.1.42.Final), NVD (< 4.1.42), Snyk (< 4.1.42.Final; < 4.1.42.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16869"
      },
      "impact_statement": "CVE-2019-16869 affects Netty before 4.1.42.Final. The target version is 4.1.76.Final, which already contains the upstream fix (commit 39cafcb05c by Norman Maurer, Sep 2019). The fix was part of the upstream release when TuxCare onboarded this version. The vulnerable pattern (unconditional whitespace acceptance before colon) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Beta1, < 4.1.42.Final), NVD (< 4.1.42), Snyk (< 4.1.42.Final; < 4.1.42.Final)."
    }
  ]
}