{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:155d932e-3cc8-51f2-aca5-1aa0e3bf5121",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4",
      "type": "library",
      "group": "io.netty",
      "name": "netty-codec-xml",
      "version": "4.1.73.Final-tuxcare.4",
      "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:e2d931a5-f3c6-554c-a92d-777965e86e98",
      "id": "CVE-2022-24823",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-24823 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4ad1a2fb-70e0-5300-8192-19e0cc855a98",
      "id": "CVE-2022-41881",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-41881 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d1a815df-9fd5-5409-a4f4-c324bff35dad",
      "id": "CVE-2022-41915",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-41915 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f97bf1d5-2fc3-5c81-bef6-f2a69419d418",
      "id": "CVE-2023-34462",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34462 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e5e7abd-e032-5287-b634-a77d358a0169",
      "id": "CVE-2023-44487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-44487 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b91b27e4-179e-54a6-9f06-d5610e5fb72d",
      "id": "CVE-2023-4586",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-xml 4.1.73.Final-tuxcare.4."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d04d9d1f-31b6-51e0-851a-ade037c4c6f6",
      "id": "CVE-2024-29025",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-29025 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:11d04e63-1051-50b5-8d87-3adc55ead1d2",
      "id": "CVE-2024-47535",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-47535 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fe77c0e7-18e0-57b4-aaf8-949e60f2a65e",
      "id": "CVE-2025-24970",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24970 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3cbba653-5d62-50c0-ae0e-1235042dc406",
      "id": "CVE-2025-25193",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-25193 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:332eeba8-d8aa-5122-8c3f-3d5d22ec36d6",
      "id": "CVE-2025-55163",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55163 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e74e63b6-69d5-5019-bcd1-353cdb8dcb0d",
      "id": "CVE-2025-58056",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58056 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c2ba4a53-f64f-5ab2-a8d5-0aceaed8a227",
      "id": "CVE-2025-58057",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58057 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ee8d6272-aa6a-5c9d-a36a-dea83acb1ec5",
      "id": "CVE-2025-59419",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59419 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7687272a-5e98-525f-a99f-4ef76d94d7b7",
      "id": "CVE-2025-67735",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-67735 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:32bbedec-4361-566b-b687-d2c258c9da19",
      "id": "CVE-2026-33870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33870 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1244da69-0b0a-5baa-a2fe-82a54d41c8e7",
      "id": "CVE-2026-33871",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33871 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7cfd6d92-44e9-524f-b4b5-630a02a27604",
      "id": "CVE-2026-41417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41417 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f2224776-321c-5fc6-aa6e-9632a38da469",
      "id": "CVE-2026-42577",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42577 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:85cd5af6-b279-50d1-9f58-7be1529a951a",
      "id": "CVE-2026-42578",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42578 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8cfec519-c465-568f-820c-45f0c4bce8ca",
      "id": "CVE-2026-42579",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42579 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:25a79d74-ba86-5f63-8e11-522f9a8e7552",
      "id": "CVE-2026-42580",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42580 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cab692f4-7262-5436-a09b-52de64b96ec8",
      "id": "CVE-2026-42581",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42581 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:400aa545-1c95-528e-b958-94f0325b3371",
      "id": "CVE-2026-42583",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42583 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:50a95fb8-e3d6-5dae-a536-90a09ab91bab",
      "id": "CVE-2026-42584",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42584 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6a0e0d6b-dc91-5107-af1b-55ebc93e26f0",
      "id": "CVE-2026-42585",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42585 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:242f538d-244f-5200-8d80-9c23a4b0bb89",
      "id": "CVE-2026-42586",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42586 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:27158b16-e551-56dc-9e48-efc2e3033b66",
      "id": "CVE-2026-42587",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42587 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:435f8ee3-1251-52ab-98a7-ce04189558a7",
      "id": "CVE-2026-44248",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44248 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:61b002f8-080b-59ed-8c32-8681127ef1f4",
      "id": "CVE-2026-44249",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44249 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:89a41214-6852-50f5-acd1-36fdbc4e42b5",
      "id": "CVE-2026-44250",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44250 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:556d081a-409b-5529-bfe9-f36c97c7b701",
      "id": "CVE-2026-44890",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44890 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c9a79f1a-29dd-5c85-9060-9ef80c332f7a",
      "id": "CVE-2026-44891",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44891 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e49a154d-3c43-5c3b-83d3-d2552090b2f6",
      "id": "CVE-2026-44893",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44893 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2f1ac743-6b96-5c56-a9e4-4465d66c5045",
      "id": "CVE-2026-45416",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45416 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4bed7f54-9960-5f61-9240-5243dab0385c",
      "id": "CVE-2026-45536",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45536 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:60ae4cc6-70e9-5618-81bf-2764391c1ded",
      "id": "CVE-2026-45673",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45673 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:43f82f63-86e5-5f3d-bc6b-6d810b4a76f9",
      "id": "CVE-2026-45674",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45674 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e10126dd-287f-5c85-afbf-4f42b68891e0",
      "id": "CVE-2026-46340",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-46340 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2a39b040-49d4-591f-a9b1-6e8bae5b7ca2",
      "id": "CVE-2026-47244",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47244 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:41b0e0f2-a7df-5d00-acdf-d4f2f25a92d0",
      "id": "CVE-2026-47691",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47691 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:18b74198-970d-50e4-8fd8-df4e0f83b6d5",
      "id": "CVE-2026-48006",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48006 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:916d52fb-b918-5aa6-9980-01b9e11a2890",
      "id": "CVE-2026-48043",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48043 does not affect version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml. not_affected \u2014 Version 4.1.73 is not affected by CVE-2026-48043. The target uses a loop-based architecture with try-finally protection (introduced in 2016) that prevents the buffer leak described in the CVE. The vulnerable ChannelInboundHandlerAdapter pattern that the upstream patch fixes does not exist in this version."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f8c708b3-b511-50de-ab55-bb6fbba81af6",
      "id": "CVE-2026-48059",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48059 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7fc0ca7a-8cd5-5afe-b074-417d5f8f4ae1",
      "id": "CVE-2026-50010",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50010 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f43dd863-92fa-5d5e-83f7-2d1b5b72e9d4",
      "id": "CVE-2026-50011",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50011 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9159934e-9ac7-5ee9-9f51-6ad72402def9",
      "id": "CVE-2026-50020",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50020 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aabd4522-85b5-5630-8cab-bab97519ef5e",
      "id": "CVE-2026-50560",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-50560 is fixed in version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8458ae91-214f-5ad6-9449-c0d02906a8a3",
      "id": "CVE-2026-55831",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55831 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:858a36cb-596e-5237-b625-5a424b708303",
      "id": "CVE-2026-55833",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55833 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e4ec1d25-5cb9-5bf5-aec7-15904b29d7dd",
      "id": "CVE-2026-55851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55851 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fc9265e5-fcb6-5b5c-89ff-d967c629d397",
      "id": "CVE-2026-56745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56745 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e0bcfa14-fa17-5775-be89-e7119c4b7bf2",
      "id": "CVE-2026-56746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56746 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e0a19de4-82f3-5188-bf76-c41ca45b24c7",
      "id": "CVE-2026-56817",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56817 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2f3293f0-b185-5a29-8e07-2d1fe2b6fe13",
      "id": "CVE-2026-56818",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56818 does not affect version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml. not_affected \u2014 The target version 4.1.73.Final-tuxcare.2 is NOT AFFECTED by CVE-2026-56818. The vulnerable code pattern (configurable `maxElements` limit check without cleanup, contrasting with `maxNestedArrayDepth` limit check WITH cleanup) was introduced in version 4.1.135.Final through commits e51c64c964 and 728c98b8ec (dated 2026-06-01/02). The target version predates these features entirely and does not ..."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:38236442-f4c0-5d9d-a5fc-52250d8a7970",
      "id": "CVE-2026-56819",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56819 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5660380d-12d8-5522-af9a-b56d6fa99e70",
      "id": "CVE-2026-59898",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59898 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1f6dd097-9c47-5630-bea4-270735990f43",
      "id": "CVE-2026-59899",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59899 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96c6c345-bf15-5f42-9a92-2b0961d2f2d7",
      "id": "CVE-2026-59900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59900 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:73938962-4862-5c45-a514-af8369301c6e",
      "id": "CVE-2026-59901",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59901 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:89343803-29f1-592e-908e-8a139ad7ec75",
      "id": "CVE-2026-59902",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59902 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:02f3f42f-1e2f-5850-8fed-45320fecef10",
      "id": "CVE-2026-59903",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59903 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b02d97c0-79ef-5f16-9846-23db066811a2",
      "id": "CVE-2026-59919",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59919 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ce17ed00-cfba-55ee-8736-55246346c20e",
      "id": "CVE-2026-59920",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59920 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:40b97e2a-0d31-5b2d-b505-fbd0c09397e1",
      "id": "CVE-2026-59921",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59921 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:31e3cafb-aa20-5244-a605-b664f0dcbe2c",
      "id": "CVE-2026-73507",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73507 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2c6490a7-dae5-52c7-8844-11c1bd687c18",
      "id": "CVE-2026-73508",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73508 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5a44383d-0fa8-57a0-8168-975268ad6eab",
      "id": "GHSA-mfg7-5gfp-c4w3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb6cf8d3-30fc-566f-8293-d2b97c57779a",
      "id": "GHSA-v74w-7mr3-4qg3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4256dd3f-49da-5c82-bdb4-5867d58969fe",
      "id": "GHSA-xpw8-rcwv-8f8p",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.73.Final-tuxcare.4 of io.netty:netty-codec-xml."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.netty/netty-codec-xml@4.1.73.Final-tuxcare.4"
    }
  ]
}