{
  "@id": "urn:uuid:9a18c3fe-6a12-41f8-9221-c7f7f470b3cb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T09:03:00.068199+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2019-20444"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "action_statement": "Vulnerability CVE-2021-21290 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "action_statement": "Vulnerability CVE-2021-43797 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:03:00.068199+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Netty 4.0.56.Final is not affected by CVE-2022-41915. The vulnerability existed in Netty 4.1.x versions due to missing validation in DefaultHeaders.setObject() methods when processing iterators/arrays. Version 4.0.x uses a fundamentally different architecture without the DefaultHeaders<K,V> generic base class or setObject methods. The equivalent methods in 4.0.x (set/add with Iterable parameter...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 Netty 4.0.56.Final is not affected by CVE-2022-41915. The vulnerability existed in Netty 4.1.x versions due to missing validation in DefaultHeaders.setObject() methods when processing iterators/arrays. Version 4.0.x uses a fundamentally different architecture without the DefaultHeaders<K,V> generic base class or setObject methods. The equivalent methods in 4.0.x (set/add with Iterable parameter..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "action_statement": "Vulnerability CVE-2024-29025 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.0.56.Final is NOT affected by CVE-2026-42580. The vulnerability requires manual byte[] chunk size accumulation with inadequate overflow check (if result < 0), a pattern introduced in Netty 4.1.x. The target uses Java's Integer.parseInt(hex, 16) which has JLS-specified overflow protection, throwing NumberFormatException for values exceeding Integer.MAX_VALUE. The CVE's attack pa...",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Target version 4.0.56.Final is NOT affected by CVE-2026-42580. The vulnerability requires manual byte[] chunk size accumulation with inadequate overflow check (if result < 0), a pattern introduced in Netty 4.1.x. The target uses Java's Integer.parseInt(hex, 16) which has JLS-specified overflow protection, throwing NumberFormatException for values exceeding Integer.MAX_VALUE. The CVE's attack pa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2026-42587 describes a bypass vulnerability in Netty 4.1.x where the maxAllocation decompression limit is ignored for Brotli/Zstd/Snappy encodings, allowing attackers to bypass configured protection by changing the Content-Encoding header. Target version 4.0.56.Final (released Feb 2018) predates both the maxAllocation feature (added May 2025 in 4.1.x) and Brotli/Zstd/Snappy decoder support (added 2021+ in 4.1.x). The specific vulnerability pattern - bypassing a configured limit via alternative encodings - cannot manifest when neither the protection mechanism nor the bypass vectors exist. The CVE's locked Goal \"decompression output exceeds the configured maxAllocation limit\" is meaningless in 4.0.56.Final where no maxAllocation can be configured.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "CVE-2026-42587 describes a bypass vulnerability in Netty 4.1.x where the maxAllocation decompression limit is ignored for Brotli/Zstd/Snappy encodings, allowing attackers to bypass configured protection by changing the Content-Encoding header. Target version 4.0.56.Final (released Feb 2018) predates both the maxAllocation feature (added May 2025 in 4.1.x) and Brotli/Zstd/Snappy decoder support (added 2021+ in 4.1.x). The specific vulnerability pattern - bypassing a configured limit via alternative encodings - cannot manifest when neither the protection mechanism nor the bypass vectors exist. The CVE's locked Goal \"decompression output exceeds the configured maxAllocation limit\" is meaningless in 4.0.56.Final where no maxAllocation can be configured."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.0.56.Final does not have the CVE-2026-56746 vulnerability. The CVE describes a logical operator error in Netty 4.1.x versions where the getForOrigin() method uses OR logic (||) instead of AND (&&), allowing Origin: null requests to bypass short-circuit protection even when isNullOriginAllowed is false. However, 4.0.56.Final uses a different architecture with a validateOrigin() ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "impact_statement": "not_affected \u2014 Target version 4.0.56.Final does not have the CVE-2026-56746 vulnerability. The CVE describes a logical operator error in Netty 4.1.x versions where the getForOrigin() method uses OR logic (||) instead of AND (&&), allowing Origin: null requests to bypass short-circuit protection even when isNullOriginAllowed is false. However, 4.0.56.Final uses a different architecture with a validateOrigin() ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.0.56.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T15:29:41.341271+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-codec-http."
    }
  ]
}