{
  "@id": "urn:uuid:17f4cde2-4e3d-4d16-b8ae-87036cfe747e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T11:14:00.047862+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T08:48:44.806640+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 does not affect version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy. not_affected \u2014 Target version 4.1.114.Final is NOT vulnerable to CVE-2022-41881. The fix for unbounded recursion in HAProxyMessage TLV parsing is already present in the target. The vulnerability was fixed upstream in Netty 4.1.86.Final, and since the target is based on 4.1.114.Final (newer than 4.1.86), the fix was included in the upstream release that TuxCare onboarded. The fix adds a MAX_NESTING_LEVEL const...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.114.Final is NOT vulnerable to CVE-2022-41881. The fix for unbounded recursion in HAProxyMessage TLV parsing is already present in the target. The vulnerability was fixed upstream in Netty 4.1.86.Final, and since the target is based on 4.1.114.Final (newer than 4.1.86), the fix was included in the upstream release that TuxCare onboarded. The fix adds a MAX_NESTING_LEVEL const..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T11:14:00.047862+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy, and is fixed in 4.1.114.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      },
      "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy, and is fixed in 4.1.114.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T11:14:00.047862+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy, and is fixed in 4.1.114.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      },
      "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy, and is fixed in 4.1.114.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T08:48:44.806640+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T08:48:44.806640+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "action_statement": "Vulnerability CVE-2026-59919 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T08:48:44.806640+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.114.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T08:48:44.806640+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.114.Final-tuxcare.3 of io.netty:netty-codec-haproxy."
    }
  ]
}