{
  "@id": "urn:uuid:a6e01d70-9191-431c-a835-58e3af50465f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T11:23:13.187034+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:23:13.187034+00:00",
      "status_notes": "Vulnerability CVE-2026-42586 is fixed in version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-42586"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:23:13.187034+00:00",
      "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-44250"
      },
      "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:23:13.187034+00:00",
      "status_notes": "Vulnerability CVE-2026-44890 is fixed in version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-44890"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:23:13.187034+00:00",
      "status_notes": "Vulnerability CVE-2026-48006 is fixed in version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-48006"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:23:13.187034+00:00",
      "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "CVE-2026-50011"
      },
      "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:23:13.187034+00:00",
      "status_notes": "Vulnerability CVE-2026-56818 does not affect version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis. not_affected \u2014 CVE-2026-56818 affects Netty versions that have the configurable `maxElements` limit in RedisArrayAggregator, where the maxElements check throws without cleanup while the sibling maxNestedArrayDepth check properly calls releaseAndClearDepths(). Version 4.1.64.Final (released May 2021) predates the introduction of these configurable limits by 5 years. The maxElements configuration was added in c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-56818"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-56818 affects Netty versions that have the configurable `maxElements` limit in RedisArrayAggregator, where the maxElements check throws without cleanup while the sibling maxNestedArrayDepth check properly calls releaseAndClearDepths(). Version 4.1.64.Final (released May 2021) predates the introduction of these configurable limits by 5 years. The maxElements configuration was added in c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:23:13.187034+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-redis@4.1.64.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:23:13.187034+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.64.Final-tuxcare.3 of io.netty:netty-codec-redis."
    }
  ]
}