{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9b37e45e-e8c8-5bdd-a1e9-d69e10215b31",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4",
      "type": "library",
      "group": "io.netty",
      "name": "netty-codec-http",
      "version": "4.1.73.Final-tuxcare.4",
      "purl": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:f9751685-5629-56db-a552-b79d606f5938",
      "id": "CVE-2022-24823",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-24823 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dbb3c308-c403-573e-9ed7-6155f2142795",
      "id": "CVE-2022-41881",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-41881 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8cccab1b-cac9-5ec1-abed-adeefb6e45ae",
      "id": "CVE-2022-41915",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-41915 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2031326e-4f40-5f53-acac-d81c6b9a44ab",
      "id": "CVE-2023-34462",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34462 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f8609794-73e2-5241-be66-5a6887f34b7b",
      "id": "CVE-2023-44487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-44487 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:44e26e20-fd30-568f-9941-3ca338ec0043",
      "id": "CVE-2023-4586",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-http 4.1.73.Final-tuxcare.4."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:39dda17c-ea28-5bbd-b510-0d0ca92f5319",
      "id": "CVE-2024-29025",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-29025 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:64d5cadc-e856-5661-ae5c-3d2e68d78f02",
      "id": "CVE-2024-47535",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-47535 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b261a5d6-4f0b-53c1-ab1d-27c4a4d0145c",
      "id": "CVE-2025-24970",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24970 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d79c29ef-69cf-5775-9f88-4344313a3eb5",
      "id": "CVE-2025-25193",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-25193 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:48df7641-ed7e-5cf5-bc6c-088dfbf71baa",
      "id": "CVE-2025-55163",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55163 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9755d6aa-abe9-5f9f-8acf-1d9521420eb2",
      "id": "CVE-2025-58056",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58056 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:75decede-38d7-5d61-9659-16497a124326",
      "id": "CVE-2025-58057",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58057 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f430a7b8-b7bd-5feb-a9e0-f244aaee70b7",
      "id": "CVE-2025-59419",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59419 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eaa9363a-ed73-5b62-a62d-a60e876632d4",
      "id": "CVE-2025-67735",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-67735 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e2d8ff9a-83c7-577f-bea1-392a9031a2d5",
      "id": "CVE-2026-33870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33870 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9e6b791b-b313-533b-a68f-0d7b81609196",
      "id": "CVE-2026-33871",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33871 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:451451d0-02ec-57ca-a26c-f83fe18302c9",
      "id": "CVE-2026-41417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41417 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:55e4e785-86c8-57a8-8997-2fc9f5789ff2",
      "id": "CVE-2026-42577",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42577 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:899b38e5-db05-55ec-8870-35a44cd2b918",
      "id": "CVE-2026-42578",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42578 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:30754b27-95c7-518a-8788-da0162849e25",
      "id": "CVE-2026-42579",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42579 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b2aabe38-9e82-5321-ad11-146833e4d00a",
      "id": "CVE-2026-42580",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42580 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0a2c87af-d894-54cf-9bac-920307bf588b",
      "id": "CVE-2026-42581",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42581 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6091a6f6-2f6c-5087-b738-796a8a703142",
      "id": "CVE-2026-42583",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42583 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:60ee2c59-1115-59ae-9a40-24f7d1c81b83",
      "id": "CVE-2026-42584",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42584 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:deaa917d-632e-5456-b94b-63c2075dbdc3",
      "id": "CVE-2026-42585",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42585 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:77e2ba93-0395-5052-a170-93c48ae265ac",
      "id": "CVE-2026-42586",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42586 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d16184d6-0b25-52b4-bfa1-7bc45a63f1bc",
      "id": "CVE-2026-42587",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42587 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b292d779-cca2-5755-8810-f9a765000cea",
      "id": "CVE-2026-44248",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44248 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:36a2d8c4-3bb0-5d20-8b00-2e19103a658c",
      "id": "CVE-2026-44249",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44249 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:80bfa704-9696-577a-9417-d9665daa93e3",
      "id": "CVE-2026-44250",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44250 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1a921417-f6af-5f29-809e-7f604115697c",
      "id": "CVE-2026-44890",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44890 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:729f8cae-00b9-5cc1-8dc3-84d0d8b89bca",
      "id": "CVE-2026-44891",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44891 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:996f6822-68b7-5bcb-9a7d-8d60729a48a8",
      "id": "CVE-2026-44893",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44893 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a69fc815-1395-50d0-827e-5d7df875f33c",
      "id": "CVE-2026-45416",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45416 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f016caa5-cfcb-55b1-abe6-fa3f1406a529",
      "id": "CVE-2026-45536",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45536 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e0686301-9b1a-5cdf-a4bc-16c4313aff61",
      "id": "CVE-2026-45673",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45673 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a0fbb880-cd35-5e9f-ae82-84772adc2135",
      "id": "CVE-2026-45674",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45674 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a75e5730-c4ba-52dc-a421-8f88001ee25e",
      "id": "CVE-2026-46340",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46340 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b8fef362-6831-5814-a1d9-460f246506b9",
      "id": "CVE-2026-47244",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47244 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5289dff6-1d5b-5c15-8b91-c8e98e7e61ae",
      "id": "CVE-2026-47691",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47691 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b3f7d073-a3f2-5a00-8b65-13ac0e761ba3",
      "id": "CVE-2026-48006",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48006 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:34c88903-dc6b-536a-91d1-5e836dd5f543",
      "id": "CVE-2026-48043",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48043 does not affect version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 Version 4.1.73 is not affected by CVE-2026-48043. The target uses a loop-based architecture with try-finally protection (introduced in 2016) that prevents the buffer leak described in the CVE. The vulnerable ChannelInboundHandlerAdapter pattern that the upstream patch fixes does not exist in this version."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:41e2c1ab-4e7a-5d44-ace9-309bbe5cb32b",
      "id": "CVE-2026-48059",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48059 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d609dc52-7a0d-5e4a-92cd-7e88e9282051",
      "id": "CVE-2026-50010",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50010 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3eed3ac5-32df-556b-b61e-468b2409909c",
      "id": "CVE-2026-50011",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50011 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a8c79ed9-96d2-56fc-b2d4-1cad1a17f5cc",
      "id": "CVE-2026-50020",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50020 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6db6658c-8e74-5c6d-b04f-956dbbfb0b50",
      "id": "CVE-2026-50560",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50560 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:05750561-3915-5817-9bfd-5bc5cc81676d",
      "id": "CVE-2026-55831",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55831 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:54f0a1b9-6efe-5f3c-a213-cf321ce95071",
      "id": "CVE-2026-55833",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55833 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:01fbe834-ed79-53c7-8040-1595051eedfe",
      "id": "CVE-2026-55851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55851 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c2d39d6d-f49e-5408-b0fc-9b159068efe7",
      "id": "CVE-2026-56745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56745 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f3845775-73fc-5701-a597-b09f06dcd06d",
      "id": "CVE-2026-56746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56746 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e9cb739d-2ad1-569d-b020-12e1bb3b608d",
      "id": "CVE-2026-56817",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56817 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:99766f94-0f68-5317-99bc-1596f3e07ce8",
      "id": "CVE-2026-56818",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56818 does not affect version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 The target version 4.1.73.Final-tuxcare.2 is NOT AFFECTED by CVE-2026-56818. The vulnerable code pattern (configurable `maxElements` limit check without cleanup, contrasting with `maxNestedArrayDepth` limit check WITH cleanup) was introduced in version 4.1.135.Final through commits e51c64c964 and 728c98b8ec (dated 2026-06-01/02). The target version predates these features entirely and does not ..."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:249c7dd3-0afb-5114-a2ac-0a33d403bf3e",
      "id": "CVE-2026-56819",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56819 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d79073a4-cef7-54bf-94c2-4da882f50e8c",
      "id": "CVE-2026-59898",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59898 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96526a22-3752-5de1-8738-9c80e3ba3798",
      "id": "CVE-2026-59899",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59899 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ee349b71-917f-5cd0-94c6-cab5e7d6fe33",
      "id": "CVE-2026-59900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59900 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3bc7871b-1a94-5c87-9506-a96d8cc0448e",
      "id": "CVE-2026-59901",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59901 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f8ff351b-ef9f-57a0-a1e4-5717545387e9",
      "id": "CVE-2026-59902",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59902 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:64184ae2-a048-5dad-a64e-84d258d29705",
      "id": "CVE-2026-59903",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59903 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9e234c03-a491-577b-9400-95a4077e1d32",
      "id": "CVE-2026-59919",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59919 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5e71a61b-80ee-5439-be3c-01c34f230a0f",
      "id": "CVE-2026-59920",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59920 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d285fa80-f07f-5a7f-b6c0-ea962b3c914d",
      "id": "CVE-2026-59921",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59921 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0ee037d9-72c5-5c54-82f6-bdc92bd7de9c",
      "id": "CVE-2026-73507",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73507 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:61f81c42-2eef-5fb3-9a6e-82034ee9783d",
      "id": "CVE-2026-73508",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73508 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9c8a374f-11e5-5807-b1c6-040205669677",
      "id": "GHSA-mfg7-5gfp-c4w3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3a818c6d-084f-5395-a1cb-e901c2b9d476",
      "id": "GHSA-v74w-7mr3-4qg3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2596a96d-6ef5-5829-a1ce-7435df987ef1",
      "id": "GHSA-xpw8-rcwv-8f8p",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-http."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.netty/netty-codec-http@4.1.73.Final-tuxcare.4"
    }
  ]
}