{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:85d27450-14b5-5f0b-89f6-9fe044d9db80",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5",
      "type": "library",
      "group": "io.netty",
      "name": "netty-codec-http2",
      "version": "4.1.63.Final-tuxcare.5",
      "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:c253b0e6-a4c9-5b94-92c2-67bed1a0263c",
      "id": "CVE-2021-37136",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-37136 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bf0a1ebb-ff43-5fb6-a58b-5fa408b6ca0f",
      "id": "CVE-2021-37137",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-37137 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ccc88121-0bf7-5440-b39a-1bd5ec249640",
      "id": "CVE-2021-43797",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-43797 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:de763734-14a2-5294-a4fa-e0b4efbfa77b",
      "id": "CVE-2022-24823",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-24823 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fbe6e93b-8ebb-50d1-a6a2-79663b6b25d6",
      "id": "CVE-2022-41881",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-41881 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6e302d5b-3e7f-5887-95eb-e2791dbe81fd",
      "id": "CVE-2022-41915",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-41915 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e9296714-f973-54d4-a563-86ef949518df",
      "id": "CVE-2023-34462",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-34462 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:caffbeb2-fb74-5e31-8fe9-7bbe9ae3f95c",
      "id": "CVE-2023-44487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-44487 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5d158d01-c631-56b9-b893-b7bc224d6fd0",
      "id": "CVE-2023-4586",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-http2 4.1.63.Final-tuxcare.5."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:adcc2b2f-870c-5c14-8e60-e40c39330383",
      "id": "CVE-2024-29025",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-29025 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ee678c6b-da87-5bba-a634-fb07337c2bf6",
      "id": "CVE-2024-47535",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-47535 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d5bdfeed-cc2f-5718-bec9-9f6f75224b51",
      "id": "CVE-2025-24970",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24970 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d6a074b6-6f11-5bfc-a168-5e7eb6abadd8",
      "id": "CVE-2025-25193",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-25193 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e136e4a1-828c-5929-a1eb-5787c3431e44",
      "id": "CVE-2025-55163",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55163 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:374f2187-a705-5b8b-b1f6-8e6b50109806",
      "id": "CVE-2025-58056",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58056 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:136cf86d-94af-5373-987f-f58610777648",
      "id": "CVE-2025-58057",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-58057 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:94ef7024-4c87-5c4c-acaa-acc402696ad4",
      "id": "CVE-2025-59419",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59419 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9753ac1a-ee94-5c7b-b6ac-bafddceaa219",
      "id": "CVE-2025-67735",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-67735 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:11717a56-3012-5b00-8941-40098eacf85f",
      "id": "CVE-2026-33870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33870 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9243130a-939a-53b6-8d15-0fa81e34204c",
      "id": "CVE-2026-33871",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33871 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:226fdb42-6135-5523-9109-a5f949c9fa91",
      "id": "CVE-2026-41417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41417 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b89043d2-78fd-577a-83c5-eaf28717d35b",
      "id": "CVE-2026-42577",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42577 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5fb5fd53-dfe6-58b2-bb10-d38eb31a4ac4",
      "id": "CVE-2026-42578",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42578 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb59a769-ae19-5e25-8a91-9d8f120e5748",
      "id": "CVE-2026-42579",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42579 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb0edf8e-0b93-563f-a143-e00a9f937201",
      "id": "CVE-2026-42580",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42580 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b1a2c122-c07b-59a2-944c-d51e207f2709",
      "id": "CVE-2026-42581",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42581 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:575f8737-6cb9-5ecb-8872-62c916dc0127",
      "id": "CVE-2026-42583",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42583 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:945ddfcc-e2f6-5f50-aa5d-2038fe766c78",
      "id": "CVE-2026-42584",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42584 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:da6e3252-9ce6-5e1e-8a18-e53cf1f26516",
      "id": "CVE-2026-42585",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42585 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:905a4dac-8ef8-5c06-aa7c-c013e1d261b5",
      "id": "CVE-2026-42586",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42586 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:85b5f31e-f824-5f8e-8aa9-b57fd4e06aaa",
      "id": "CVE-2026-42587",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42587 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c8a59e55-8638-5d82-a712-a3e09c3d83f0",
      "id": "CVE-2026-44248",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44248 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:51983782-2bb2-5023-82b5-65c6be6c31e4",
      "id": "CVE-2026-44249",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44249 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f283f6b6-2dbb-5e1e-9e7f-e947fb848249",
      "id": "CVE-2026-44250",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44250 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:03c12022-6716-5145-b954-af110dc18662",
      "id": "CVE-2026-44890",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44890 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:298a33f4-f1e2-5a01-91c1-290e49f493a1",
      "id": "CVE-2026-44891",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44891 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:546ce288-d99b-5b7a-b775-0ede03954f8b",
      "id": "CVE-2026-44893",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44893 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:233b1543-a873-5d23-9dec-6b9d493f9ff7",
      "id": "CVE-2026-45416",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45416 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:162002e0-7222-5c64-ac4a-a9c89db667e9",
      "id": "CVE-2026-45536",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45536 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:417280c7-62f4-5741-87e6-cbbe01442892",
      "id": "CVE-2026-45673",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45673 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:985416e9-7154-5e40-b7cc-e3876f537460",
      "id": "CVE-2026-45674",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45674 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ce9a8b44-6c31-5606-bdaf-66fa9b923fc2",
      "id": "CVE-2026-46340",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46340 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ba29b3d6-4b17-5879-8c94-46b9fdc9c83e",
      "id": "CVE-2026-47244",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47244 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:401ce096-d58e-5981-82b5-eadb58223ac4",
      "id": "CVE-2026-47691",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47691 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:15ff7f3a-4953-56fb-943c-526141c55c94",
      "id": "CVE-2026-48006",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48006 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9d238ac0-f7d1-5de7-8408-915315e635f6",
      "id": "CVE-2026-48043",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-48043 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:99810d6d-851f-508f-9edb-3838a8d8b67e",
      "id": "CVE-2026-48059",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48059 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4b617b2c-d429-5e83-8a92-0ad8904112c2",
      "id": "CVE-2026-50010",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50010 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:95c9b1a0-bcc0-5a59-85d9-c004e4a83f7b",
      "id": "CVE-2026-50011",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50011 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fcda239d-6ee7-52b3-8f9c-8183d72597a2",
      "id": "CVE-2026-50020",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50020 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:62c5d8f2-7fdc-5fa4-82e8-884580e5dd51",
      "id": "CVE-2026-50560",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50560 is fixed in version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:82f3c8e5-3b1a-5493-9a9d-e9e42b89dd9d",
      "id": "CVE-2026-55831",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55831 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e50fef11-be18-53b5-9cb1-59dd4c1100cf",
      "id": "CVE-2026-55833",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55833 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bc76c488-1d6c-5ab7-942f-d4823119e8dd",
      "id": "CVE-2026-55851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55851 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ca302eef-803d-5140-9b82-8ea52d0b1895",
      "id": "CVE-2026-56745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56745 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c6873cff-806d-5cbb-b37c-a42614c8147d",
      "id": "CVE-2026-56746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56746 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e0db5d5b-b7de-58c0-b90d-6bd850c65636",
      "id": "CVE-2026-56817",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56817 does not affect version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2. not_affected \u2014 The Netty codec-xml module contains XmlDecoder, which instantiates an Aalto XML parser without security configuration (line 38: new InputFactoryImpl() with no XXE protection). However, this is a library component that Netty itself does not use in its own production code. The vulnerability only manifests when downstream applications explicitly add XmlDecoder to their Netty channel pipelines. Per..."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4641ba40-9df7-5560-9b39-62bd44d52a35",
      "id": "CVE-2026-56818",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56818 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:60e03364-dced-52ce-bc8b-df003bef7a24",
      "id": "CVE-2026-56819",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56819 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d06d0787-c15e-54de-8e83-837ab3d33468",
      "id": "CVE-2026-59898",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59898 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9437fba6-bca7-5990-a8d4-788cf6dbaf7d",
      "id": "CVE-2026-59899",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59899 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:90127e1c-aac7-5579-a64b-5e94544e3ba7",
      "id": "CVE-2026-59900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59900 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:94935b80-a03f-5f16-bbac-4cff3c4b383c",
      "id": "CVE-2026-59901",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59901 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ba6e5f57-cb5e-57ce-b21e-e8646b689529",
      "id": "CVE-2026-59902",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59902 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fd281876-016f-5296-8479-82f2ed813b91",
      "id": "CVE-2026-59903",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59903 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2d16064c-f914-5b89-bd96-ba44fcd263b6",
      "id": "CVE-2026-59919",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59919 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7d3f77ab-876a-5f94-8ba1-220bba5a9a36",
      "id": "CVE-2026-59920",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59920 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8e3976b5-005c-5fcf-bd63-1959cbd74a3f",
      "id": "CVE-2026-59921",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59921 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ef2ce450-9df8-5486-9859-e6032dc5a0f7",
      "id": "CVE-2026-73507",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73507 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2b713d65-7344-5298-bdd4-f2b21c1396a0",
      "id": "CVE-2026-73508",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73508 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e76e970b-a827-5026-ba59-291fdade177a",
      "id": "GHSA-mfg7-5gfp-c4w3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8d27d5e5-0842-56c9-94ca-d1c9748458c8",
      "id": "GHSA-v74w-7mr3-4qg3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ebbc390a-3d73-5c87-8e94-c9a3502ed1d6",
      "id": "GHSA-xpw8-rcwv-8f8p",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.63.Final-tuxcare.5 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.5"
    }
  ]
}