{ "@id": "urn:uuid:1a5514b0-9af9-4b1f-ab82-ee80427dd135", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-23T09:19:30.173236+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:09.619561+00:00", "status_notes": "Vulnerability CVE-2019-16869 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2019-16869" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:09.619561+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:09.619561+00:00", "status_notes": "Vulnerability CVE-2021-21295 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-21295" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-21409" }, "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:09.619561+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:30.173236+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. not_affected \u2014 CVE-2023-34462 affects Netty's fragmented TLS handshake support, which allows allocation of up to 16MB per connection without validation. Version 4.1.39.Final (released August 13, 2019) is NOT AFFECTED because the vulnerable code was introduced later. The fragmented handshake support that enables multi-record ClientHello buffering was added in commit 29c471ec52 on November 29, 2019\u2014over 3 month...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 CVE-2023-34462 affects Netty's fragmented TLS handshake support, which allows allocation of up to 16MB per connection without validation. Version 4.1.39.Final (released August 13, 2019) is NOT AFFECTED because the vulnerable code was introduced later. The fragmented handshake support that enables multi-record ClientHello buffering was added in commit 29c471ec52 on November 29, 2019\u2014over 3 month..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-xml 4.1.39.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:09.619561+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. not_affected \u2014 Version 4.1.39.Final is not affected by CVE-2025-25193. The vulnerability exists in the BoundedInputStream class, which does not exist in this version. BoundedInputStream was introduced in a later version (between 4.1.39.Final and 4.1.118.Final) as part of the fix for CVE-2024-47535 (GHSA-xq3w-v528-46rv). Since the vulnerable component is not present in the codebase, this version cannot be affe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Version 4.1.39.Final is not affected by CVE-2025-25193. The vulnerability exists in the BoundedInputStream class, which does not exist in this version. BoundedInputStream was introduced in a later version (between 4.1.39.Final and 4.1.118.Final) as part of the fix for CVE-2024-47535 (GHSA-xq3w-v528-46rv). Since the vulnerable component is not present in the codebase, this version cannot be affe..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:09.619561+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:09.619561+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2025-59419 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-59419" }, "action_statement": "Vulnerability CVE-2025-59419 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42579 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42579" }, "action_statement": "Vulnerability CVE-2026-42579 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. not_affected \u2014 Version 4.1.39.Final is NOT AFFECTED by CVE-2026-42580. This version uses Java's built-in Integer.parseInt(hex, 16) for chunk size parsing, which throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerability exists only in later Netty versions (4.1.94+) that refactored to manual hex parsing with int accumulation, where the overflow check only caught negative values. The...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Version 4.1.39.Final is NOT AFFECTED by CVE-2026-42580. This version uses Java's built-in Integer.parseInt(hex, 16) for chunk size parsing, which throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerability exists only in later Netty versions (4.1.94+) that refactored to manual hex parsing with int accumulation, where the overflow check only caught negative values. The..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. Target version Netty 4.1.39.Final is not affected by CVE-2026-42587. This version predates the vulnerable features: it does not support Brotli, Zstd, or Snappy compression for HTTP content encoding, and does not have the maxAllocation parameter. The vulnerability requires both alternative compression codec support AND the maxAllocation bypass behavior - neither exist in this version. HttpContentDecompressor and DelegatingDecompressorFrameListener only handle GZIP and DEFLATE encodings, returning null for any unsupported encoding including br/zstd/snappy.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Target version Netty 4.1.39.Final is not affected by CVE-2026-42587. This version predates the vulnerable features: it does not support Brotli, Zstd, or Snappy compression for HTTP content encoding, and does not have the maxAllocation parameter. The vulnerability requires both alternative compression codec support AND the maxAllocation bypass behavior - neither exist in this version. HttpContentDecompressor and DelegatingDecompressorFrameListener only handle GZIP and DEFLATE encodings, returning null for any unsupported encoding including br/zstd/snappy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. not_affected \u2014 CVE-2026-44248 concerns MQTT 5 Properties section parsing before size limits in MqttDecoder. Target version 4.1.39.Final only supports MQTT 3.1 and MQTT 3.1.1 (MqttVersion enum shows MQTT_3_1 and MQTT_3_1_1 only, no MQTT_5). MQTT Properties are an MQTT 5-specific feature introduced to Netty in commit fb4a57826b (2020-08-31), after the 4.1.39.Final release (2019). The target codebase has no Mqtt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 CVE-2026-44248 concerns MQTT 5 Properties section parsing before size limits in MqttDecoder. Target version 4.1.39.Final only supports MQTT 3.1 and MQTT 3.1.1 (MqttVersion enum shows MQTT_3_1 and MQTT_3_1_1 only, no MQTT_5). MQTT Properties are an MQTT 5-specific feature introduced to Netty in commit fb4a57826b (2020-08-31), after the 4.1.39.Final release (2019). The target codebase has no Mqtt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. Version 4.1.39.Final does not contain the vulnerable code described in CVE-2026-44249. The CVE specifically targets the IpSubnetFilterRule.compareTo(InetSocketAddress) method which performs bitwise AND using networkAddress instead of subnetMask. This compareTo method does not exist in 4.1.39.Final - it was added later in commit 303f2722f8 (Feb 2024) and first appeared in versions 4.1.108+. TuxCare backported the fix down to 4.1.52.Final but not to 4.1.39.Final because the vulnerable method is not present in that older version. The existing matches() method in 4.1.39.Final correctly uses subnetMask in its bitwise AND operation (line 156).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "Version 4.1.39.Final does not contain the vulnerable code described in CVE-2026-44249. The CVE specifically targets the IpSubnetFilterRule.compareTo(InetSocketAddress) method which performs bitwise AND using networkAddress instead of subnetMask. This compareTo method does not exist in 4.1.39.Final - it was added later in commit 303f2722f8 (Feb 2024) and first appeared in versions 4.1.108+. TuxCare backported the fix down to 4.1.52.Final but not to 4.1.39.Final because the vulnerable method is not present in that older version. The existing matches() method in 4.1.39.Final correctly uses subnetMask in its bitwise AND operation (line 156)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:09.619561+00:00", "status_notes": "Vulnerability CVE-2026-44893 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-44893" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. Version 4.1.39.Final is NOT AFFECTED by CVE-2026-45416. The vulnerable class SslClientHelloHandler does not exist in this version (introduced February 2020, after 4.1.39.Final's June 2019 release). The CVE describes a specific vulnerability where SslClientHelloHandler.decode() reads a 24-bit TLS handshake length and eagerly allocates ctx.alloc().buffer(handshakeLength), causing huge unpooled allocations when maxClientHelloLength=0 disables the guard. In version 4.1.39.Final, AbstractSniHandler handles TLS ClientHello parsing but uses a fundamentally different architecture: it processes ClientHello messages inline from the input ByteBuf without reading the 24-bit handshake length field or performing eager buffer allocation. The attack chain from INPUT (TLS ClientHello with large declared length) to GOAL (excessive memory allocation) is broken because the dangerous operation (eager allocation based on handshake length) does not exist in this version's code. Type A2 applies: INPUT is received but no path reaches the GOAL due to the missing implementation of the vulnerable mechanism.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.39.Final is NOT AFFECTED by CVE-2026-45416. The vulnerable class SslClientHelloHandler does not exist in this version (introduced February 2020, after 4.1.39.Final's June 2019 release). The CVE describes a specific vulnerability where SslClientHelloHandler.decode() reads a 24-bit TLS handshake length and eagerly allocates ctx.alloc().buffer(handshakeLength), causing huge unpooled allocations when maxClientHelloLength=0 disables the guard. In version 4.1.39.Final, AbstractSniHandler handles TLS ClientHello parsing but uses a fundamentally different architecture: it processes ClientHello messages inline from the input ByteBuf without reading the 24-bit handshake length field or performing eager buffer allocation. The attack chain from INPUT (TLS ClientHello with large declared length) to GOAL (excessive memory allocation) is broken because the dangerous operation (eager allocation based on handshake length) does not exist in this version's code. Type A2 applies: INPUT is received but no path reaches the GOAL due to the missing implementation of the vulnerable mechanism." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-45674 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-45674" }, "action_statement": "Vulnerability CVE-2026-45674 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:30.173236+00:00", "status_notes": "Vulnerability CVE-2026-46340 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-46340" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:19:30.173236+00:00", "status_notes": "Vulnerability CVE-2026-48059 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-48059" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-56818 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-56818" }, "action_statement": "Vulnerability CVE-2026-56818 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. not_affected \u2014 Target version 4.1.39.Final is not affected by CVE-2026-59919. The vulnerability requires BOTH (1) accepting AF_UNIX addresses with CRLF characters AND (2) encoding them into HAProxy V1 text protocol format. The target has the data flaw (no CRLF validation in HAProxyMessage.checkAddress() at line 421), but lacks the encoding component (HAProxyMessageEncoder) that was added to upstream Netty in ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Target version 4.1.39.Final is not affected by CVE-2026-59919. The vulnerability requires BOTH (1) accepting AF_UNIX addresses with CRLF characters AND (2) encoding them into HAProxy V1 text protocol format. The target has the data flaw (no CRLF validation in HAProxyMessage.checkAddress() at line 421), but lacks the encoding component (HAProxyMessageEncoder) that was added to upstream Netty in ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml. Netty 4.1.39.Final is not affected by CVE-2026-75596. The vulnerability exists in SslClientHelloHandler, a class that was introduced in version 4.1.46.Final (February 2020), well after the 4.1.39.Final release. The target version uses AbstractSniHandler with a different architecture that assumes ClientHello messages fit within a single TLS record and does not perform fragment aggregation. Therefore, the quadratic buffer recopying vulnerability pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Netty 4.1.39.Final is not affected by CVE-2026-75596. The vulnerability exists in SslClientHelloHandler, a class that was introduced in version 4.1.46.Final (February 2020), well after the 4.1.39.Final release. The target version uses AbstractSniHandler with a different architecture that assumes ClientHello messages fit within a single TLS record and does not perform fragment aggregation. Therefore, the quadratic buffer recopying vulnerability pattern described in the CVE does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-xml." } ] }