{
  "@id": "urn:uuid:2bb74c5b-0143-4233-8d55-061dc12ef407",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:20:07.636772+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-compression@4.2.12.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-compression@4.2.12.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:20:07.636772+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-compression. not_affected \u2014 The target Netty 4.2.12.Final is not affected by CVE-2025-58057. The vulnerability (unbounded memory accumulation in decompressing decoders) was fixed in upstream commit 9d804c54ce by Norman Maurer, which shipped in the upstream 4.2.12.Final release before TuxCare's onboarding. The fix changed BrotliDecoder, ZstdDecoder, JZlibDecoder, and JdkZlibDecoder to immediately forward decompressed chunk...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.2.12.Final is not affected by CVE-2025-58057. The vulnerability (unbounded memory accumulation in decompressing decoders) was fixed in upstream commit 9d804c54ce by Norman Maurer, which shipped in the upstream 4.2.12.Final release before TuxCare's onboarding. The fix changed BrotliDecoder, ZstdDecoder, JZlibDecoder, and JdkZlibDecoder to immediately forward decompressed chunk..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-compression@4.2.12.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-compression@4.2.12.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:20:07.636772+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-compression.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-compression@4.2.12.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-compression@4.2.12.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:20:07.636772+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-compression.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-compression."
    }
  ]
}