{
  "@id": "urn:uuid:e38fdbbe-ccbe-44cc-89a4-c376b367a7aa",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T09:47:23.789022+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T09:47:23.789022+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 does not affect version 4.2.12.Final-tuxcare.4 of io.netty:netty-codec. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 4.2.12.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-grg4-wf29-r9vv (affected up to 4.1.68.Final), NVD (affected up to 4.1.68), CVE record (affected up to 4.1.68Final), Snyk (affected up to 4.1.68.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 4.2.12.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-grg4-wf29-r9vv (affected up to 4.1.68.Final), NVD (affected up to 4.1.68), CVE record (affected up to 4.1.68Final), Snyk (affected up to 4.1.68.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T09:47:23.789022+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 does not affect version 4.2.12.Final-tuxcare.4 of io.netty:netty-codec. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 4.2.12.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-9vjp-v76f-g363 (affected up to 4.1.68.Final), NVD (affected up to 4.1.68), CVE record (affected up to 4.1.68Final), Snyk (affected up to 4.1.68.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 4.2.12.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-9vjp-v76f-g363 (affected up to 4.1.68.Final), NVD (affected up to 4.1.68), CVE record (affected up to 4.1.68Final), Snyk (affected up to 4.1.68.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T09:47:23.789022+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.2.12.Final-tuxcare.4 of io.netty:netty-codec. not_affected \u2014 The target Netty 4.2.12.Final is not affected by CVE-2025-58057. The vulnerability (unbounded memory accumulation in decompressing decoders) was fixed in upstream commit 9d804c54ce by Norman Maurer, which shipped in the upstream 4.2.12.Final release before TuxCare's onboarding. The fix changed BrotliDecoder, ZstdDecoder, JZlibDecoder, and JdkZlibDecoder to immediately forward decompressed chunk...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.2.12.Final is not affected by CVE-2025-58057. The vulnerability (unbounded memory accumulation in decompressing decoders) was fixed in upstream commit 9d804c54ce by Norman Maurer, which shipped in the upstream 4.2.12.Final release before TuxCare's onboarding. The fix changed BrotliDecoder, ZstdDecoder, JZlibDecoder, and JdkZlibDecoder to immediately forward decompressed chunk..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T09:47:23.789022+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 is fixed in version 4.2.12.Final-tuxcare.4 of io.netty:netty-codec.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec@4.2.12.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T09:47:23.789022+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.2.12.Final-tuxcare.4 of io.netty:netty-codec.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.2.12.Final-tuxcare.4 of io.netty:netty-codec."
    }
  ]
}