{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e411f835-9f08-50b0-b6e2-673c38f94bdf", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1", "type": "library", "group": "io.netty", "name": "netty-codec-http2", "version": "4.1.122.Final-tuxcare.1", "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:360bebb0-b8be-5a4b-83ac-299a9b1be717", "id": "CVE-2025-55163", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55163 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cc5b3992-66a2-5cec-a63f-6d0f29d06670", "id": "CVE-2025-58056", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58056 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8983458f-5307-59be-b8d6-8dbbda5dc55d", "id": "CVE-2025-58057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58057 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3807af23-b49a-5817-9770-04fee31ab614", "id": "CVE-2025-59419", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59419 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:741e2f71-2ada-5dfd-954b-da2f1c49a901", "id": "CVE-2025-67735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-67735 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b4089c9-918d-5d57-a7b6-96414dfa269d", "id": "CVE-2026-33870", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33870 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:908645e8-eb5f-5716-a392-9da8afe319d9", "id": "CVE-2026-33871", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33871 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d54ce67e-cd12-5428-910a-33b9ee794eb5", "id": "CVE-2026-41417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41417 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b81dc5b3-2bca-5640-9c13-cc0b01be0fe1", "id": "CVE-2026-42577", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42577 does not affect version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2. CVE-2026-42577 affects Netty 4.2.x only (advisory range >= 4.2.0.Final, < 4.2.13.Final). An fd left registered with an epoll event mask of 0 is woken forever by the unmaskable EPOLLERR/EPOLLHUP after a RST on a half-closed connection. Target 4.1.122.Final is NOT affected due to architectural differences. The patch modifies EpollIoHandler.java and EpollIoOps.java, part of 4.2's IoHandler/IoOps abstraction. Neither file exists in 4.1.x, which registers via EpollEventLoop.modify() off AbstractEpollChannel.flags. That field is seeded Native.EPOLLET, and no read/close/half-close path clears it (only the explicit pre-registration setEpollMode(LEVEL_TRIGGERED) opt-in), so the registration stays edge-triggered and the RST is reported once per edge instead of on every epoll_wait. The chain from INPUT (connection state change) to GOAL (CPU busy-loop via empty event mask) is broken at step (ii): the target cannot produce an empty event mask. Verdict: not_affected. Justification: code_not_reachable (Rule 5 Type A2)." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:04417629-1054-5eb8-860a-53d9b5f52c97", "id": "CVE-2026-42578", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42578 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:321debe6-c833-5054-99c4-53d81bad7c37", "id": "CVE-2026-42579", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42579 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d0de2608-2274-5fba-ad91-b0c0491230eb", "id": "CVE-2026-42580", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42580 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f31064b-9861-55ac-96b0-77c781ee287b", "id": "CVE-2026-42581", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42581 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7822bcdc-b98a-5f04-85ec-bc3e30ef5f64", "id": "CVE-2026-42583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42583 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f8a99cbb-60f8-506f-b5ab-21925697b613", "id": "CVE-2026-42584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42584 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5f3ed4eb-60f6-5bcc-b09a-bedf11c8849d", "id": "CVE-2026-42585", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42585 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:47cb66af-339d-5cff-81ca-38c2e301fcc1", "id": "CVE-2026-42586", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42586 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:945329e4-39da-5d80-8d8c-e30ddf95a64d", "id": "CVE-2026-42587", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42587 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eb7deccc-c7c1-5acd-8db7-3d432e5d7cb3", "id": "CVE-2026-44248", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44248 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cd23aa31-2af8-5c9f-9d86-aded65d4b891", "id": "CVE-2026-44249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44249 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4404904f-8236-58ea-bbc9-c98b9a43e0be", "id": "CVE-2026-44250", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44250 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dabf919f-8686-5252-8790-b516b5eea585", "id": "CVE-2026-44890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44890 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c4874bcb-bc32-573c-8360-b7acfa41b9ea", "id": "CVE-2026-44891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44891 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7a567ccb-c4ee-5b6c-ad60-dc7aacee4395", "id": "CVE-2026-44893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44893 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e439d3da-f92e-5b80-b780-8e8f71c8e2c7", "id": "CVE-2026-45416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45416 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cca2612b-ebcd-56f9-82d1-862f12a42a16", "id": "CVE-2026-45536", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45536 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c3045440-6b6f-5fff-9c11-7eb4a6dec944", "id": "CVE-2026-45673", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45673 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ad83c686-23ce-5ecf-91b6-cb9d5bc403f5", "id": "CVE-2026-45674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45674 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d1160258-bb4d-5771-9c48-b8eec3ecbfbf", "id": "CVE-2026-46340", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46340 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4636efea-d787-5068-89fb-800c01ca14e0", "id": "CVE-2026-47244", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47244 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d6d240f6-bde4-50e3-a2ac-b82867b9d5de", "id": "CVE-2026-47691", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47691 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7204f043-b106-5af4-a3a1-1bffdfb0861c", "id": "CVE-2026-48006", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48006 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e8f9f216-d26b-5152-82cf-4857370dca24", "id": "CVE-2026-48043", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48043 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a73e34aa-fc45-5ead-b0a7-8e62e39bc8e4", "id": "CVE-2026-48059", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48059 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:44ac445d-4af6-57ad-bed8-da4b82187e6f", "id": "CVE-2026-50010", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50010 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b41f8ca4-00bc-5a8b-ac42-302766b08f64", "id": "CVE-2026-50011", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50011 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fc4d916a-105e-542a-b6a5-6d92f0c60ca4", "id": "CVE-2026-50020", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50020 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ec0820d7-8abf-5ebc-9f18-3052fb71d5e2", "id": "CVE-2026-50560", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50560 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:04bf51bd-ed85-5f1b-81d0-f3b7a6601859", "id": "CVE-2026-55831", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55831 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ddd8f741-8fa5-5fd8-8ec1-e88126ebb7f6", "id": "CVE-2026-55833", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55833 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a11b07c7-1aa9-5883-8036-6b5f0d39929d", "id": "CVE-2026-55851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55851 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4c0173a0-6298-5b74-8507-9d2a48ee357f", "id": "CVE-2026-56745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56745 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b556ceae-92d0-59be-9659-fee6814459db", "id": "CVE-2026-56746", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56746 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2d9d0cb0-f55b-56de-bac1-b2ca112d744e", "id": "CVE-2026-56817", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56817 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:36b06a1b-6a30-59a5-beb5-1958a1a0d19d", "id": "CVE-2026-56818", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56818 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c8429f8d-471d-5370-92af-e5c43f2b1c27", "id": "CVE-2026-56819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56819 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dcbf3f49-10d6-5aa6-bd23-a7ae93eae9d3", "id": "CVE-2026-56820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56820 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3c376655-6d99-5bb1-81b2-848d7ff9a8f3", "id": "CVE-2026-56821", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56821 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:77c87254-2631-5373-ad3c-feb99e1012e7", "id": "CVE-2026-56822", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56822 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f1990cbc-86e2-55f0-8834-712c060952b0", "id": "CVE-2026-59898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59898 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5c8844c8-641e-5c44-810b-96be9f895a21", "id": "CVE-2026-59899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59899 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee3daa68-bd39-5acd-9c68-1bc720cc2980", "id": "CVE-2026-59900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59900 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f8bf1b95-d4e7-50e6-9771-864203192f44", "id": "CVE-2026-59901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59901 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e32c71ae-1a44-59fd-a8cb-daab34c65122", "id": "CVE-2026-59902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59902 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:39806a50-8372-5595-a83e-0599d05d0185", "id": "CVE-2026-59903", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59903 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ba73deb5-744f-59f0-adb2-d56e5014aa11", "id": "CVE-2026-59919", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59919 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1dd9d83-625e-5329-9faf-97dba57ecee5", "id": "CVE-2026-59920", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59920 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d38142d3-02a9-53c0-923e-015a4c21dd7d", "id": "CVE-2026-59921", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59921 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ba43cebd-08a1-5289-971d-aca38c78ec5f", "id": "CVE-2026-73507", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-73507 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ea544783-5657-58e6-9786-90a526775dff", "id": "CVE-2026-73508", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-73508 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1f9105ce-85cc-5dec-a1f3-d4e01480ec4a", "id": "GHSA-mfg7-5gfp-c4w3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:be249c15-44c8-5918-9c20-d5181c1ebc2b", "id": "GHSA-v74w-7mr3-4qg3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.122.Final-tuxcare.1 of io.netty:netty-codec-http2." }, "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.122.Final-tuxcare.1" } ] }