{
  "@id": "urn:uuid:fadd2b11-e09c-46d2-a5ba-b3c43d30dbb5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T08:04:43.899001+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-smtp@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-smtp@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2025-59419 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec-smtp. not_affected \u2014 The target repository (Netty 4.1.128.Final) is NOT vulnerable to CVE-2025-59419. The fix for SMTP command injection was already present in the upstream release 4.1.128.Final when TuxCare onboarded it. The vulnerable pattern (lack of CRLF validation in SMTP parameters) is not present because upstream commit 2b3fddd333 added comprehensive validation logic (SmtpUtils.validateSMTPParameters) that r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-59419"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.128.Final) is NOT vulnerable to CVE-2025-59419. The fix for SMTP command injection was already present in the upstream release 4.1.128.Final when TuxCare onboarded it. The vulnerable pattern (lack of CRLF validation in SMTP parameters) is not present because upstream commit 2b3fddd333 added comprehensive validation logic (SmtpUtils.validateSMTPParameters) that r..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-smtp@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-smtp@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec-smtp.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-smtp@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-smtp@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec-smtp.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec-smtp."
    }
  ]
}