{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d9653d69-762a-5fda-bd18-1eb8a46a76ce",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2",
      "type": "library",
      "group": "io.netty",
      "name": "netty-codec-http2",
      "version": "4.1.63.Final-tuxcare.2",
      "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:91afc403-e53f-56fe-bc7c-ea6dd411ce53",
      "id": "CVE-2021-37136",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-37136 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0389cb65-9017-5457-b555-606e63b69ecc",
      "id": "CVE-2021-37137",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-37137 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c1864a30-137a-5e0f-9882-4298a9bc8072",
      "id": "CVE-2021-43797",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-43797 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dea3cc26-d14e-5c5d-8c03-e09d519e9384",
      "id": "CVE-2022-24823",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-24823 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cde83716-6c10-5798-b785-0c8eb82a77cf",
      "id": "CVE-2022-41881",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-41881 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6b852dc6-7b5e-51ad-9fe1-05ae2f93ef1e",
      "id": "CVE-2022-41915",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-41915 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b8014428-d96f-5bf6-be7f-2cf010319051",
      "id": "CVE-2023-34462",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-34462 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aeeae4a4-e36a-5b76-8ce1-29579adcc7f9",
      "id": "CVE-2023-44487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-44487 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:80d2186f-62cc-5099-89e2-6abd12f7ed37",
      "id": "CVE-2023-4586",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-http2 4.1.63.Final-tuxcare.2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e4ec38eb-92ba-572a-8152-3c72692d0ef2",
      "id": "CVE-2024-29025",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-29025 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a61552d0-2022-55f1-8c40-4248aa728c86",
      "id": "CVE-2024-47535",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-47535 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:15b8cb93-feca-5d8b-a146-8a6919472913",
      "id": "CVE-2025-24970",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-24970 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5de3b122-2cfa-553a-8eca-dc7adb04c2e5",
      "id": "CVE-2025-25193",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-25193 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8d576271-593d-578e-8edf-d01bd585daba",
      "id": "CVE-2025-55163",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55163 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2a24b4b2-5a45-5600-847a-db254679c168",
      "id": "CVE-2025-58056",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58056 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:31cbdcac-8a89-594e-848c-4523dd0804ad",
      "id": "CVE-2025-58057",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-58057 is fixed in version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ab3cd77b-b215-50a3-8d6b-d1e7e5d40641",
      "id": "CVE-2025-59419",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59419 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6133f0ac-444f-5b71-b7a6-7d350013d8b8",
      "id": "CVE-2025-67735",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-67735 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cab0f0b8-9508-540a-a7d8-e525611fceaf",
      "id": "CVE-2026-33870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33870 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5dd43f94-6e8e-5188-80c3-f4db2aed0fde",
      "id": "CVE-2026-33871",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33871 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cb7f36e9-dae8-5710-8a9f-9ca3312ad1e4",
      "id": "CVE-2026-41417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41417 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:13da413f-5cba-50ab-9cd5-ad9e8a0177fb",
      "id": "CVE-2026-42577",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42577 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fd3e2963-a100-540c-8060-a2baeb98098a",
      "id": "CVE-2026-42578",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42578 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:27b4a96d-6b67-5c62-a10b-a96409fe0600",
      "id": "CVE-2026-42579",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42579 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:85d153d9-5a65-58a3-8b67-a97bc685375b",
      "id": "CVE-2026-42580",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42580 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fceb3d0b-11a0-5227-ac48-3d493c66b9bd",
      "id": "CVE-2026-42581",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42581 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a6bb0550-d999-56c7-a096-f4a0f7a68403",
      "id": "CVE-2026-42583",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42583 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:30e0e6e8-f234-57a1-9a9e-69409ef8895e",
      "id": "CVE-2026-42584",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42584 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c14a3fb5-07e4-5c7c-b7b2-0eee89eada61",
      "id": "CVE-2026-42585",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42585 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d9f61221-7c79-5e04-985f-5ce5562b02a8",
      "id": "CVE-2026-42586",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42586 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ce88110f-c8fe-56a9-980f-46beca4dfeae",
      "id": "CVE-2026-42587",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42587 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:680decf3-cf6d-5e78-bac4-8334e0d3b9bb",
      "id": "CVE-2026-44248",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44248 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88ca7d89-f5db-5648-8d74-8945cdd3a36f",
      "id": "CVE-2026-44249",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44249 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e659a09-d4d3-50b2-ae8c-4af180c62991",
      "id": "CVE-2026-44250",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44250 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96c89129-058e-5744-947f-efc1e4a70c3f",
      "id": "CVE-2026-44890",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44890 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e2651a3a-ae41-5373-a52c-83e9e7c996b4",
      "id": "CVE-2026-44891",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44891 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2a5ba646-c54a-5694-bd05-38607f35bd16",
      "id": "CVE-2026-44893",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44893 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:97543e69-5688-5747-9baa-d04a2cf98fde",
      "id": "CVE-2026-45416",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45416 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:295e832b-9a93-57d4-a157-bad9227313bc",
      "id": "CVE-2026-45536",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45536 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0b3af452-8104-5a14-b076-5f17a36b3779",
      "id": "CVE-2026-45673",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45673 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ad1d469b-174d-59a2-b249-f5c67657f49e",
      "id": "CVE-2026-45674",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45674 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88ff88ba-28ef-5f19-8fcb-447761463464",
      "id": "CVE-2026-46340",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46340 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2d3cd35e-ea1a-5a0d-9bf8-de0d7df0c4af",
      "id": "CVE-2026-47244",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47244 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8981282b-be6d-5e51-a7e0-232a3313ca64",
      "id": "CVE-2026-47691",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47691 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bdc9b442-6169-5614-87b9-5303a351c157",
      "id": "CVE-2026-48006",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48006 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:51af20ed-e364-5d77-8196-54ce3665a9c6",
      "id": "CVE-2026-48043",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48043 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:43f89dad-f5e9-5315-860c-f11fa51a76d1",
      "id": "CVE-2026-48059",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48059 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6eca4cac-a02d-54be-8c1b-a414eb0b74cc",
      "id": "CVE-2026-50010",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50010 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b75d90ab-7636-597c-8293-d1863eb238be",
      "id": "CVE-2026-50011",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50011 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ea5b72a2-1ba7-565a-84ad-cf8db53f09e7",
      "id": "CVE-2026-50020",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50020 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:16daac10-68e6-5591-b8a3-cd3c4423b8b9",
      "id": "CVE-2026-50560",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50560 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:66d3fca8-cc86-5874-8847-2bf87d0c9850",
      "id": "CVE-2026-55831",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55831 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3aeebe7b-99f4-5e62-b3bb-ce8f5309d9ee",
      "id": "CVE-2026-55833",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55833 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:17163316-cde8-5fd5-be6b-0b29d85106f3",
      "id": "CVE-2026-55851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55851 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d9cb1705-ec5d-5ac6-a84f-dc2ca530440a",
      "id": "CVE-2026-56745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56745 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:79c21b48-3757-54e6-b0cf-f5b38bda600c",
      "id": "CVE-2026-56746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56746 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a10361c-342f-50f1-9dfb-357c8147d34d",
      "id": "CVE-2026-56817",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-56817 does not affect version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 The Netty codec-xml module contains XmlDecoder, which instantiates an Aalto XML parser without security configuration (line 38: new InputFactoryImpl() with no XXE protection). However, this is a library component that Netty itself does not use in its own production code. The vulnerability only manifests when downstream applications explicitly add XmlDecoder to their Netty channel pipelines. Per..."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:727f5371-b27a-589d-8ac8-ec48f379ee77",
      "id": "CVE-2026-59898",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59898 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d48ad74e-d476-5e52-bf97-d2ef391fce9a",
      "id": "CVE-2026-59899",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59899 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:98f3b0b7-e938-5b43-a689-785dc89fbe38",
      "id": "CVE-2026-59900",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59900 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d3261020-be81-510a-a318-f03a6293b6db",
      "id": "CVE-2026-59901",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59901 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a15051bf-cb7e-5157-98f7-0b195e0d0007",
      "id": "CVE-2026-59919",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59919 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c2b7f8fe-b4bd-5868-bb75-094f7f4fb5dd",
      "id": "CVE-2026-59920",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59920 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c84c3aee-4b0f-5e16-a214-bbbcd93b9f12",
      "id": "CVE-2026-59921",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59921 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:41f13592-823f-5870-88c8-a4c66db5932c",
      "id": "GHSA-mfg7-5gfp-c4w3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b546df39-5c99-5ba4-bf60-7ef7d061284f",
      "id": "GHSA-v74w-7mr3-4qg3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6612a870-fa90-57e5-b4ed-f29c4405cc79",
      "id": "GHSA-xpw8-rcwv-8f8p",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.63.Final-tuxcare.2 of io.netty:netty-codec-http2."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.63.Final-tuxcare.2"
    }
  ]
}