{
  "@id": "urn:uuid:7f736fef-302b-43ae-b5f2-ac4a678dbb97",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:46:03.666447+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T14:46:03.666447+00:00",
      "status_notes": "Vulnerability CVE-2022-41881 does not affect version 4.2.2.Final-tuxcare.3 of io.netty:netty-codec-haproxy. not_affected \u2014 CVE-2022-41881 is NOT present in Netty 4.2.2.Final-tuxcare.1. The vulnerability (unbounded recursion in HAProxy TLV parsing causing StackOverflowError) was fixed in upstream Netty commit cd91cf3c99123bd1e53fd6a1de0e3d1922f05bb2 by Norman Maurer, and this fix was already included in the upstream Netty 4.2.2.Final release that TuxCare onboarded. The target code contains the MAX_NESTING_LEVEL defe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41881"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41881 is NOT present in Netty 4.2.2.Final-tuxcare.1. The vulnerability (unbounded recursion in HAProxy TLV parsing causing StackOverflowError) was fixed in upstream Netty commit cd91cf3c99123bd1e53fd6a1de0e3d1922f05bb2 by Norman Maurer, and this fix was already included in the upstream Netty 4.2.2.Final release that TuxCare onboarded. The target code contains the MAX_NESTING_LEVEL defe..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T14:46:03.666447+00:00",
      "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.2.2.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-44893"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T14:46:03.666447+00:00",
      "status_notes": "Vulnerability CVE-2026-48059 affects version 4.2.2.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-48059"
      },
      "action_statement": "Vulnerability CVE-2026-48059 affects version 4.2.2.Final-tuxcare.3 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T14:46:03.666447+00:00",
      "status_notes": "Vulnerability CVE-2026-55851 affects version 4.2.2.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-55851"
      },
      "action_statement": "Vulnerability CVE-2026-55851 affects version 4.2.2.Final-tuxcare.3 of io.netty:netty-codec-haproxy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-haproxy@4.2.2.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T14:46:03.666447+00:00",
      "status_notes": "Vulnerability CVE-2026-59919 affects version 4.2.2.Final-tuxcare.3 of io.netty:netty-codec-haproxy.",
      "vulnerability": {
        "name": "CVE-2026-59919"
      },
      "action_statement": "Vulnerability CVE-2026-59919 affects version 4.2.2.Final-tuxcare.3 of io.netty:netty-codec-haproxy."
    }
  ]
}