{
  "@id": "urn:uuid:7d62561b-2c96-45ee-aec2-d43dcbba4371",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T07:46:21.871751+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T07:46:21.871751+00:00",
      "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.23.Final-tuxcare.3 of io.netty:netty-codec-mqtt. not_affected \u2014 Target version 4.1.23.Final (released April 2018) does not implement MQTT 5 protocol. The vulnerability concerns MQTT 5's Properties section parsing, which was introduced to Netty on 2020-08-31 (commit fb4a57826b), approximately 2.5 years after this version was released. The target only supports MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections in their protocol specifications. The...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44248"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.23.Final (released April 2018) does not implement MQTT 5 protocol. The vulnerability concerns MQTT 5's Properties section parsing, which was introduced to Netty on 2020-08-31 (commit fb4a57826b), approximately 2.5 years after this version was released. The target only supports MQTT 3.1 and MQTT 3.1.1, which do not have Properties sections in their protocol specifications. The..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-mqtt@4.1.23.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T07:46:21.871751+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.3 of io.netty:netty-codec-mqtt.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.3 of io.netty:netty-codec-mqtt."
    }
  ]
}