{
  "@id": "urn:uuid:537d8018-7726-4484-96ac-9a460c39579e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:20:07.636772+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-smtp@4.2.12.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-smtp@4.2.12.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:20:07.636772+00:00",
      "status_notes": "Vulnerability CVE-2025-59419 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-smtp. not_affected \u2014 Netty 4.2.12.Final contains the CRLF validation fix that prevents CVE-2025-59419. The validation logic (SmtpUtils.validateSMTPParameters) is present in DefaultSmtpRequest constructors and blocks injection attempts by throwing IllegalArgumentException when parameters contain CR or LF characters. This fix was authored by DepthFirst Disclosures (disclosures@depthfirst.com) and shipped in upstream ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-59419"
      },
      "impact_statement": "not_affected \u2014 Netty 4.2.12.Final contains the CRLF validation fix that prevents CVE-2025-59419. The validation logic (SmtpUtils.validateSMTPParameters) is present in DefaultSmtpRequest constructors and blocks injection attempts by throwing IllegalArgumentException when parameters contain CR or LF characters. This fix was authored by DepthFirst Disclosures (disclosures@depthfirst.com) and shipped in upstream ..."
    }
  ]
}