{
  "@id": "urn:uuid:8d57061d-6cd7-4738-b90c-b70823a5043e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.48.Final-tuxcare.3 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "CVE-2026-56817"
      },
      "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.48.Final-tuxcare.3 of io.netty:netty-codec-xml."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-73507 does not affect version 4.1.48.Final-tuxcare.3 of io.netty:netty-codec-xml. not_affected \u2014 Netty 4.1.48.Final-tuxcare.1 is not affected by CVE-2026-73507. While the XmlFrameDecoder class contains the vulnerable CPU exhaustion pattern (unbounded buffer rescanning when processing repeated `</` sequences), Netty is a library that exports this class but does not use it in any production code. Per MRA Type A1, the vulnerable code path (attacker XML input \u2192 XmlFrameDecoder.decode() \u2192 CPU e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73507"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.48.Final-tuxcare.1 is not affected by CVE-2026-73507. While the XmlFrameDecoder class contains the vulnerable CPU exhaustion pattern (unbounded buffer rescanning when processing repeated `</` sequences), Netty is a library that exports this class but does not use it in any production code. Per MRA Type A1, the vulnerable code path (attacker XML input \u2192 XmlFrameDecoder.decode() \u2192 CPU e..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.3 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.3 of io.netty:netty-codec-xml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.48.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.3 of io.netty:netty-codec-xml.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.3 of io.netty:netty-codec-xml."
    }
  ]
}