{ "@id": "urn:uuid:2a07a9df-fe29-4816-b67c-925c0a1452a1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 4, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-20T12:46:51.138394+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2021-21409 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-21409" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-37136" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Version 4.1.42.Final is not affected by CVE-2023-34462. The vulnerable code (fragmented ClientHello handling with unvalidated handshakeLength-based buffer allocation) was introduced in commit 29c471ec52 on 2019-11-29, approximately two months AFTER the 4.1.42.Final release (2019-09-25). The target version only supports ClientHello messages within a single TLS record and parses them directly fro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Version 4.1.42.Final is not affected by CVE-2023-34462. The vulnerable code (fragmented ClientHello handling with unvalidated handshakeLength-based buffer allocation) was introduced in commit 29c471ec52 on 2019-11-29, approximately two months AFTER the 4.1.42.Final release (2019-09-25). The target version only supports ClientHello messages within a single TLS record and parses them directly fro..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache, and is fixed in 4.1.42.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2024-29025" }, "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache, and is fixed in 4.1.42.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-24970" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-17T09:08:00.177306+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2025-59419 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-59419" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-42579 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42579" }, "action_statement": "Vulnerability CVE-2026-42579 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Target version 4.1.42.Final is NOT AFFECTED by CVE-2026-42580. The target uses a fundamentally different chunk size parsing implementation than the vulnerable upstream code. While upstream versions manually parse hex bytes with inadequate overflow checking (result *= 16; result += digit; if (result < 0)), the target delegates to Java's standard Integer.parseInt(hex, 16), which has built-in over...", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Target version 4.1.42.Final is NOT AFFECTED by CVE-2026-42580. The target uses a fundamentally different chunk size parsing implementation than the vulnerable upstream code. While upstream versions manually parse hex bytes with inadequate overflow checking (result *= 16; result += digit; if (result < 0)), the target delegates to Java's standard Integer.parseInt(hex, 16), which has built-in over..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-17T09:08:00.177306+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache. Version 4.1.42.Final is NOT affected by CVE-2026-42587. The vulnerability concerns BrotliDecoder, ZstdDecoder, and SnappyFrameDecoder ignoring the maxAllocation parameter for decompression bomb protection. However, these decoders and their corresponding Content-Encoding support (br, zstd, snappy) do NOT exist in this version. Both HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip and deflate encodings, returning null for unsupported encodings. The compressed input types described in the CVE are not processed by this version, so the vulnerability cannot manifest. Brotli, Zstd, and Snappy support were added in much later versions (post-4.1.42).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Version 4.1.42.Final is NOT affected by CVE-2026-42587. The vulnerability concerns BrotliDecoder, ZstdDecoder, and SnappyFrameDecoder ignoring the maxAllocation parameter for decompression bomb protection. However, these decoders and their corresponding Content-Encoding support (br, zstd, snappy) do NOT exist in this version. Both HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip and deflate encodings, returning null for unsupported encodings. The compressed input types described in the CVE are not processed by this version, so the vulnerability cannot manifest. Brotli, Zstd, and Snappy support were added in much later versions (post-4.1.42)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Version 4.1.42.Final is not affected by CVE-2026-44248. This vulnerability is specific to MQTT 5 Properties parsing, but version 4.1.42.Final only supports MQTT 3.1 and 3.1.1 protocols. MQTT 5 support (including the MqttProperties class and decodeProperties() method) was added 883 commits after this release. Since the target cannot receive or parse MQTT 5 messages with Properties sections, the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 Version 4.1.42.Final is not affected by CVE-2026-44248. This vulnerability is specific to MQTT 5 Properties parsing, but version 4.1.42.Final only supports MQTT 3.1 and 3.1.1 protocols. MQTT 5 support (including the MqttProperties class and decodeProperties() method) was added 883 commits after this release. Since the target cannot receive or parse MQTT 5 messages with Properties sections, the ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-44893" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache. Target version 4.1.42.Final (released Sept 2019) is NOT AFFECTED by CVE-2026-45416. The vulnerability requires SslClientHelloHandler.decode() which performs eager allocation based on the 24-bit handshake length field when ClientHello spans multiple TLS records. This class was introduced in February 2020 (commit 8304069a30, PR #9827), approximately 4.5 months AFTER 4.1.42.Final was released. Version 4.1.42.Final uses a completely different architecture where AbstractSniHandler extends ByteToMessageDecoder directly and processes ClientHello in-place from the cumulative input buffer, reading only the 16-bit TLS record length (max ~64KB per record) without any eager allocation based on the 24-bit handshake length. The specific attack chain described in the CVE (reading handshakeLength via getUnsignedMedium, then ctx.alloc().buffer(handshakeLength)) does not exist in this version. Rule 5 Type A2 applies: INPUT is received, but no path from input-receiving code reaches the GOAL (uncontrolled memory allocation based on attacker-supplied handshake length).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Target version 4.1.42.Final (released Sept 2019) is NOT AFFECTED by CVE-2026-45416. The vulnerability requires SslClientHelloHandler.decode() which performs eager allocation based on the 24-bit handshake length field when ClientHello spans multiple TLS records. This class was introduced in February 2020 (commit 8304069a30, PR #9827), approximately 4.5 months AFTER 4.1.42.Final was released. Version 4.1.42.Final uses a completely different architecture where AbstractSniHandler extends ByteToMessageDecoder directly and processes ClientHello in-place from the cumulative input buffer, reading only the 16-bit TLS record length (max ~64KB per record) without any eager allocation based on the 24-bit handshake length. The specific attack chain described in the CVE (reading handshakeLength via getUnsignedMedium, then ctx.alloc().buffer(handshakeLength)) does not exist in this version. Rule 5 Type A2 applies: INPUT is received, but no path from input-receiving code reaches the GOAL (uncontrolled memory allocation based on attacker-supplied handshake length)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-45674 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-45674" }, "action_statement": "Vulnerability CVE-2026-45674 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-46340 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache, and is fixed in 4.1.42.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-46340" }, "action_statement": "Vulnerability CVE-2026-46340 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache, and is fixed in 4.1.42.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2026-48059 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-48059" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-56818 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 CVE-2026-56818 describes a resource leak in RedisArrayAggregator's maxElements validation check (throws without calling releaseAndClearDepths). The target version 4.1.42.Final does not have the maxElements feature, maxNestedArrayDepth feature, or releaseAndClearDepths method. These features were introduced in later commits (e51c64c964, 728c98b8ec, ced30adba2) after 4.1.42.Final was released. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56818" }, "impact_statement": "not_affected \u2014 CVE-2026-56818 describes a resource leak in RedisArrayAggregator's maxElements validation check (throws without calling releaseAndClearDepths). The target version 4.1.42.Final does not have the maxElements feature, maxNestedArrayDepth feature, or releaseAndClearDepths method. These features were introduced in later commits (e51c64c964, 728c98b8ec, ced30adba2) after 4.1.42.Final was released. Th..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:55:41.957093+00:00", "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-56819" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-17T09:08:00.177306+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache. not_affected \u2014 Target version 4.1.42.Final is not affected by CVE-2026-59919. The vulnerable component HAProxyMessageEncoder does not exist in this version (added later in 2020 via commit #10175). Additionally, the V1 protocol decoder explicitly rejects AF_UNIX addresses (line 327-330 in HAProxyMessage.java), preventing UNIX socket paths from being used in V1 contexts. The vulnerability requires: (1) HAProxyM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Target version 4.1.42.Final is not affected by CVE-2026-59919. The vulnerable component HAProxyMessageEncoder does not exist in this version (added later in 2020 via commit #10175). Additionally, the V1 protocol decoder explicitly rejects AF_UNIX addresses (line 327-330 in HAProxyMessage.java), preventing UNIX socket paths from being used in V1 contexts. The vulnerability requires: (1) HAProxyM..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache. Netty 4.1.42.Final is not affected by CVE-2026-75596. The vulnerable component io.netty.handler.ssl.SslClientHelloHandler does not exist in this version\u2014it was introduced 4 months after the 4.1.42.Final release (Sept 2019) in commit 8304069a30 (Feb 2020). The CVE describes quadratic CPU complexity from repeated buffer clear+re-copy operations when aggregating fragmented TLS ClientHello messages. This specific vulnerability pattern (handshakeBuffer.clear() followed by unconditional writeBytes re-copying all accumulated data) is unique to SslClientHelloHandler and does not exist in the alternative SNI implementation (AbstractSniHandler) present in 4.1.42.Final. AbstractSniHandler uses ByteToMessageDecoder's linear cumulation and parses ClientHello in-place without buffer re-copying, avoiding the quadratic complexity entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Netty 4.1.42.Final is not affected by CVE-2026-75596. The vulnerable component io.netty.handler.ssl.SslClientHelloHandler does not exist in this version\u2014it was introduced 4 months after the 4.1.42.Final release (Sept 2019) in commit 8304069a30 (Feb 2020). The CVE describes quadratic CPU complexity from repeated buffer clear+re-copy operations when aggregating fragmented TLS ClientHello messages. This specific vulnerability pattern (handshakeBuffer.clear() followed by unconditional writeBytes re-copying all accumulated data) is unique to SslClientHelloHandler and does not exist in the alternative SNI implementation (AbstractSniHandler) present in 4.1.42.Final. AbstractSniHandler uses ByteToMessageDecoder's linear cumulation and parses ClientHello in-place without buffer re-copying, avoiding the quadratic complexity entirely." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-memcache@4.1.42.Final-tuxcare.1" } } ], "timestamp": "2026-10-15T13:52:29.952159+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-memcache." } ] }