{
  "@id": "urn:uuid:c73696a9-4439-4b82-b19b-e1def66a5903",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:24:19.585233+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-all@4.2.2.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-all@4.2.2.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T15:54:00.084020+00:00",
      "status_notes": "Vulnerability CVE-2014-0193 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-all. not_affected \u2014 CVE-2014-0193: The target repository (Netty 4.2.2.Final) is not affected. The vulnerable code pattern - unbounded text accumulation via the fragmentedFramesText field in WebSocket08FrameDecoder - was removed by upstream Netty in April 2014 (commits 787a85f, 48edb78, etc.) and the fix was already present in the upstream 4.2.2.Final release that TuxCare onboarded in September 2026. The current co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-0193"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-0193: The target repository (Netty 4.2.2.Final) is not affected. The vulnerable code pattern - unbounded text accumulation via the fragmentedFramesText field in WebSocket08FrameDecoder - was removed by upstream Netty in April 2014 (commits 787a85f, 48edb78, etc.) and the fix was already present in the upstream 4.2.2.Final release that TuxCare onboarded in September 2026. The current co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-all@4.2.2.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-all@4.2.2.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2019-16869 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-all. CVE-2019-16869 affects Netty versions before 4.1.42.Final due to improper handling of whitespace before the colon in HTTP headers, enabling HTTP request smuggling. The target version 4.2.2.Final already contains the upstream fix (commit 39cafcb0) authored by Norman Maurer (Apple) which was shipped in the original Netty 4.2.2.Final release. The vulnerable code pattern is not present in HEAD because the fix predates TuxCare's onboarding of this version (first TuxCare commit 6d8479fc \"ELSJAVA-667 Setup\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Beta1, < 4.1.42.Final), NVD (< 4.1.42), Snyk (< 4.1.42.Final; < 4.1.42.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16869"
      },
      "impact_statement": "CVE-2019-16869 affects Netty versions before 4.1.42.Final due to improper handling of whitespace before the colon in HTTP headers, enabling HTTP request smuggling. The target version 4.2.2.Final already contains the upstream fix (commit 39cafcb0) authored by Norman Maurer (Apple) which was shipped in the original Netty 4.2.2.Final release. The vulnerable code pattern is not present in HEAD because the fix predates TuxCare's onboarding of this version (first TuxCare commit 6d8479fc \"ELSJAVA-667 Setup\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Beta1, < 4.1.42.Final), NVD (< 4.1.42), Snyk (< 4.1.42.Final; < 4.1.42.Final)."
    }
  ]
}