{ "@id": "urn:uuid:d5dc8149-e082-4eef-a367-a661f7eb9ac3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-23T10:01:00.133959+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-21409" }, "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2022-41915" }, "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Netty version 4.1.29.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability exists in a refactored architecture introduced between versions 4.1.29.Final (Sept 2018) and 4.1.50.Final (June 2020). The target version uses an older architecture where ClientHello parsing is performed in-place without the multi-record accumulation feature that enables the 16MB buffer allocation attack. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty version 4.1.29.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability exists in a refactored architecture introduced between versions 4.1.29.Final (Sept 2018) and 4.1.50.Final (June 2020). The target version uses an older architecture where ClientHello parsing is performed in-place without the multi-record accumulation feature that enables the 16MB buffer allocation attack. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-memcache 4.1.29.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Version 4.1.29.Final does not have the BoundedInputStream class that CVE-2025-25193 patches. This CVE specifically addresses a bug in BoundedInputStream (introduced to fix CVE-2024-47535) where null bytes were not counted toward the input limit. Since BoundedInputStream does not exist in 4.1.29.Final, the specific bug described in CVE-2025-25193 cannot be present. TuxCare backports of this CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Version 4.1.29.Final does not have the BoundedInputStream class that CVE-2025-25193 patches. This CVE specifically addresses a bug in BoundedInputStream (introduced to fix CVE-2024-47535) where null bytes were not counted toward the input limit. Since BoundedInputStream does not exist in 4.1.29.Final, the specific bug described in CVE-2025-25193 cannot be present. TuxCare backports of this CVE ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-59419 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-59419" }, "action_statement": "Vulnerability CVE-2025-59419 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42577 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42577" }, "action_statement": "Vulnerability CVE-2026-42577 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42579 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42579" }, "action_statement": "Vulnerability CVE-2026-42579 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Target version 4.1.29.Final is not affected by CVE-2026-42580. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow validation. When the PoC chunk size \"100000004\" (0x100000004 = 4,294,967,300) exceeds Integer.MAX_VALUE (2,147,483,647), parseInt throws NumberFormatException. The exception is caught and invalidChunk consumes the entire buffer, preventing ...", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Target version 4.1.29.Final is not affected by CVE-2026-42580. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow validation. When the PoC chunk size \"100000004\" (0x100000004 = 4,294,967,300) exceeds Integer.MAX_VALUE (2,147,483,647), parseInt throws NumberFormatException. The exception is caught and invalidChunk consumes the entire buffer, preventing ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. Netty 4.1.29.Final is not affected by CVE-2026-42587. This version predates the vulnerable feature: HttpContentDecompressor has no maxAllocation parameter and does not support brotli, zstd, or snappy encodings. The CVE describes a bypass of maxAllocation protection for these encodings in later versions that added this decompression bomb protection feature. Since the feature does not exist in 4.1.29.Final, the vulnerability pattern cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Netty 4.1.29.Final is not affected by CVE-2026-42587. This version predates the vulnerable feature: HttpContentDecompressor has no maxAllocation parameter and does not support brotli, zstd, or snappy encodings. The CVE describes a bypass of maxAllocation protection for these encodings in later versions that added this decompression bomb protection feature. Since the feature does not exist in 4.1.29.Final, the vulnerability pattern cannot manifest." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Target version 4.1.29.Final only supports MQTT v3.1/v3.1.1 and does not have MQTT 5 support. The CVE-2026-44248 vulnerability is specific to MQTT 5's Properties section parsing in variable headers. Since MQTT 5 support is absent (no MqttProperties class, no decodeProperties() method, MqttVersion enum only contains MQTT_3_1 and MQTT_3_1_1), the target cannot process MQTT 5 messages with Properti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 Target version 4.1.29.Final only supports MQTT v3.1/v3.1.1 and does not have MQTT 5 support. The CVE-2026-44248 vulnerability is specific to MQTT 5's Properties section parsing in variable headers. Since MQTT 5 support is absent (no MqttProperties class, no decodeProperties() method, MqttVersion enum only contains MQTT_3_1 and MQTT_3_1_1), the target cannot process MQTT 5 messages with Properti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo(InetSocketAddress) method that incorrectly uses networkAddress instead of subnetMask for bitwise AND operations. Version 4.1.29.Final does NOT have this compareTo method (different architecture - the class only implements IpFilterRule, not Comparable). The actual filtering in this version is performed by the matches() method (line 156) which CORRECTLY uses subnetMask. While an unsigned BigInteger conversion issue exists at line 170 (not passing signum=1), this is a separate issue from the specific CVE-described bug. The CVE's attack chain (compareTo \u2192 wrong mask \u2192 bypass) does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo(InetSocketAddress) method that incorrectly uses networkAddress instead of subnetMask for bitwise AND operations. Version 4.1.29.Final does NOT have this compareTo method (different architecture - the class only implements IpFilterRule, not Comparable). The actual filtering in this version is performed by the matches() method (line 156) which CORRECTLY uses subnetMask. While an unsigned BigInteger conversion issue exists at line 170 (not passing signum=1), this is a separate issue from the specific CVE-described bug. The CVE's attack chain (compareTo \u2192 wrong mask \u2192 bypass) does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44893" }, "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. Version 4.1.29.Final does not contain the vulnerable code pattern. The vulnerability requires SslClientHelloHandler, which was introduced after this version (git commit 8304069a30). The existing AbstractSniHandler only processes single-record ClientHello messages and never allocates buffers based on the 24-bit handshake length field. Multi-record ClientHello handling functionality is entirely absent from this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.29.Final does not contain the vulnerable code pattern. The vulnerability requires SslClientHelloHandler, which was introduced after this version (git commit 8304069a30). The existing AbstractSniHandler only processes single-record ClientHello messages and never allocates buffers based on the 24-bit handshake length field. Multi-record ClientHello handling functionality is entirely absent from this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-45674 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-45674" }, "action_statement": "Vulnerability CVE-2026-45674 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-46340 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-46340" }, "action_statement": "Vulnerability CVE-2026-46340 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-48059" }, "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-56818 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56818" }, "action_statement": "Vulnerability CVE-2026-56818 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Target version 4.1.29.Final is not affected by CVE-2026-59919. The vulnerability requires HAProxyMessageEncoder.encodeV1() to write AF_UNIX addresses containing CRLF characters to V1 text-based protocol format, causing protocol injection. However, this version: (1) has no HAProxyMessageEncoder class at all - only a decoder exists, (2) the V1 decoder explicitly rejects AF_UNIX protocols (HAProxy...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Target version 4.1.29.Final is not affected by CVE-2026-59919. The vulnerability requires HAProxyMessageEncoder.encodeV1() to write AF_UNIX addresses containing CRLF characters to V1 text-based protocol format, causing protocol injection. However, this version: (1) has no HAProxyMessageEncoder class at all - only a decoder exists, (2) the V1 decoder explicitly rejects AF_UNIX protocols (HAProxy..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache. CVE-2026-75596 affects SslClientHelloHandler, a component introduced in Netty AFTER version 4.1.29.Final. The target uses AbstractSniHandler which does NOT aggregate ClientHello fragments across multiple TLS records and cannot exhibit the quadratic CPU vulnerability. The vulnerable code path with handshakeBuffer.clear() + writeBytes() re-copy pattern does not exist in this version. TuxCare backported the fix to versions 4.1.119.Final+ which have SslClientHelloHandler, but 4.1.29.Final never had the vulnerable component.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "CVE-2026-75596 affects SslClientHelloHandler, a component introduced in Netty AFTER version 4.1.29.Final. The target uses AbstractSniHandler which does NOT aggregate ClientHello fragments across multiple TLS records and cannot exhibit the quadratic CPU vulnerability. The vulnerable code path with handshakeBuffer.clear() + writeBytes() re-copy pattern does not exist in this version. TuxCare backported the fix to versions 4.1.119.Final+ which have SslClientHelloHandler, but 4.1.29.Final never had the vulnerable component." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-memcache." } ] }