{
  "@id": "urn:uuid:1de0f7fd-d89e-417e-be9f-52867fc366fb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T08:04:43.899001+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. The upstream fix was released in 4.1.68.Final, and version 4.1.128.Final is a later release of the same line. Advisories: GitHub GHSA-grg4-wf29-r9vv (fixed in 4.1.68.Final), NVD (fixed in 4.1.68), CVE record (fixed in 4.1.68Final), Snyk (fixed in 4.1.68.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. The upstream fix was released in 4.1.68.Final, and version 4.1.128.Final is a later release of the same line. Advisories: GitHub GHSA-grg4-wf29-r9vv (fixed in 4.1.68.Final), NVD (fixed in 4.1.68), CVE record (fixed in 4.1.68Final), Snyk (fixed in 4.1.68.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.68.Final, and version 4.1.128.Final is a later release of the same line. Advisories: GitHub GHSA-9vjp-v76f-g363 (fixed in 4.1.68.Final), NVD (fixed in 4.1.68), CVE record (fixed in 4.1.68Final), Snyk (fixed in 4.1.68.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.68.Final, and version 4.1.128.Final is a later release of the same line. Advisories: GitHub GHSA-9vjp-v76f-g363 (fixed in 4.1.68.Final), NVD (fixed in 4.1.68), CVE record (fixed in 4.1.68Final), Snyk (fixed in 4.1.68.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec. not_affected \u2014 The upstream Netty project fixed CVE-2025-58057 in commit 34894ac73b (September 2025) by modifying BrotliDecoder and other decompressing decoders to forward decompressed buffers incrementally instead of accumulating them in a list. This fix shipped in Netty version 4.1.128.Final. When TuxCare onboarded 4.1.128.Final in October 2026, the fix was already present in the upstream release. The curre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "impact_statement": "not_affected \u2014 The upstream Netty project fixed CVE-2025-58057 in commit 34894ac73b (September 2025) by modifying BrotliDecoder and other decompressing decoders to forward decompressed buffers incrementally instead of accumulating them in a list. This fix shipped in Netty version 4.1.128.Final. When TuxCare onboarded 4.1.128.Final in October 2026, the fix was already present in the upstream release. The curre..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 is fixed in version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-codec."
    }
  ]
}