{
  "@id": "urn:uuid:6a612a69-beb5-4030-bb92-b7c07aa7dedc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-smtp@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-smtp@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T08:41:00.306335+00:00",
      "status_notes": "Vulnerability CVE-2025-59419 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-smtp. not_affected \u2014 The target repository (Netty 4.1.130.Final-tuxcare.4) is not affected by CVE-2025-59419 (SMTP Command Injection via CRLF injection). The vulnerability was fixed by the upstream Netty project in commit 2b3fddd3339cde1601f622b9ce5e54c39f24c3f9, which was already present in the 4.1.130.Final release that TuxCare onboarded. The fix adds validation in SmtpUtils.validateSMTPParameter() that checks al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-59419"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.130.Final-tuxcare.4) is not affected by CVE-2025-59419 (SMTP Command Injection via CRLF injection). The vulnerability was fixed by the upstream Netty project in commit 2b3fddd3339cde1601f622b9ce5e54c39f24c3f9, which was already present in the 4.1.130.Final release that TuxCare onboarded. The fix adds validation in SmtpUtils.validateSMTPParameter() that checks al..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-smtp@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-smtp@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-smtp, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-smtp, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-smtp@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-smtp@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-smtp, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-smtp, and is fixed in 4.1.130.Final-tuxcare.3."
    }
  ]
}