{
  "@id": "urn:uuid:91fcae62-7183-490e-b74a-85f3c6f2ec85",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:56:44.311599+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T08:45:00.145682+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 does not affect version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy. not_affected \u2014 CVE-2022-41881 is NOT present in target version 4.1.117.Final. The vulnerability (infinite recursion in HAProxy TLV parsing leading to StackOverflowError) was fixed in upstream Netty 4.1.86.Final by commit cd91cf3c99. The fix adds a MAX_NESTING_LEVEL=128 constant and nesting depth check that throws HAProxyProtocolException when exceeded. This upstream fix was already present in the 4.1.117.Fina...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41881 is NOT present in target version 4.1.117.Final. The vulnerability (infinite recursion in HAProxy TLV parsing leading to StackOverflowError) was fixed in upstream Netty 4.1.86.Final by commit cd91cf3c99. The fix adds a MAX_NESTING_LEVEL=128 constant and nesting depth check that throws HAProxyProtocolException when exceeded. This upstream fix was already present in the 4.1.117.Fina..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      },
      "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      },
      "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "action_statement": "Vulnerability CVE-2026-59919 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.1.117.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.117.Final-tuxcare.1 of io.netty:netty-codec-haproxy, and is fixed in 4.1.117.Final-tuxcare.3."
    }
  ]
}