{ "@id": "urn:uuid:b37a863b-4935-42b9-9d2a-7b45ffc749dd", "role": "Document Creator", "author": "https://tuxcare.com", "version": 23, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:40:01.312839+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-11-05T09:40:01.312839+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before 4.1.44. The target version is 4.1.107.Final, which already contains the upstream fix. The vulnerability allowed HTTP headers without colons to be parsed, potentially enabling HTTP request smuggling or header injection. The fix (commit a7c18d44b4) adds validation in HttpObjectDecoder.splitHeader() at lines 1128-1131 that throws IllegalArgumentException when a header line lacks a colon. This fix was shipped in upstream Netty 4.1.44 (released Dec 2019) and was included in the 4.1.107.Final release that TuxCare onboarded. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 affects Netty before 4.1.44. The target version is 4.1.107.Final, which already contains the upstream fix. The vulnerability allowed HTTP headers without colons to be parsed, potentially enabling HTTP request smuggling or header injection. The fix (commit a7c18d44b4) adds validation in HttpObjectDecoder.splitHeader() at lines 1128-1131 that throws IllegalArgumentException when a header line lacks a colon. This fix was shipped in upstream Netty 4.1.44 (released Dec 2019) and was included in the 4.1.107.Final release that TuxCare onboarded. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.107.Final) is NOT affected by CVE-2021-21290. The vulnerability involved insecure temporary file creation with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData, potentially exposing uploaded file contents to unauthorized local users. The upstream fix, authored by Norman Maurer (Apple/Netty), replaced File.createTempFile() with Files.createTempFile...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.107.Final) is NOT affected by CVE-2021-21290. The vulnerability involved insecure temporary file creation with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData, potentially exposing uploaded file contents to unauthorized local users. The upstream fix, authored by Norman Maurer (Apple/Netty), replaced File.createTempFile() with Files.createTempFile..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 fix is already present in netty 4.1.107.Final. The upstream fix (commit 07aa6b5938a8) was merged on Dec 9, 2021, and was included in the upstream release that TuxCare onboarded on Aug 13, 2026. The vulnerable pattern (silently skipping non-OWS control characters at the start of HTTP header names) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 fix is already present in netty 4.1.107.Final. The upstream fix (commit 07aa6b5938a8) was merged on Dec 9, 2021, and was included in the upstream release that TuxCare onboarded on Aug 13, 2026. The vulnerable pattern (silently skipping non-OWS control characters at the start of HTTP header names) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in Netty 4.1.107.Final. The vulnerability involved insecure temporary file permissions on Java 6 when createTempFile() was called with directory=null, which would return immediately without applying permission restrictions. The upstream fix (commit 185f8b2756a by Norman Maurer, released in Netty 4.1.77.Final) modified the code to always apply setReadable() permissi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in Netty 4.1.107.Final. The vulnerability involved insecure temporary file permissions on Java 6 when createTempFile() was called with directory=null, which would return immediately without applying permission restrictions. The upstream fix (commit 185f8b2756a by Norman Maurer, released in Netty 4.1.77.Final) modified the code to always apply setReadable() permissi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T08:52:00.039034+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is not present in the target. The vulnerability involved missing header value validation in DefaultHeaders.setObject() methods when called with iterators or arrays, allowing HTTP Response Splitting via CRLF injection. The upstream fix (commit fe18adff1c by christianvest_hansen@apple.com) added validateValue() calls before add0() in both setObject(Iterable) and setObject(Object......", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 is not present in the target. The vulnerability involved missing header value validation in DefaultHeaders.setObject() methods when called with iterators or arrays, allowing HTTP Response Splitting via CRLF injection. The upstream fix (commit fe18adff1c by christianvest_hansen@apple.com) added validateValue() calls before add0() in both setObject(Iterable) and setObject(Object......" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42580" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55831 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56746 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59898 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59899 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59921 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.107.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.107.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }