{
  "@id": "urn:uuid:3ad7344a-a901-459a-8415-2e765a7e0f51",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T09:40:01.312839+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:40:01.312839+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty versions before 4.1.44. The target version 4.1.112.Final already contains the upstream fix (commit a7c18d44b4) that validates HTTP headers must contain a colon character. The fix was authored by norman_maurer@apple.com and shipped in the upstream release before TuxCare onboarded this version. The vulnerable code pattern (missing colon validation in HttpObjectDecoder.splitHeader()) is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty versions before 4.1.44. The target version 4.1.112.Final already contains the upstream fix (commit a7c18d44b4) that validates HTTP headers must contain a colon character. The fix was authored by norman_maurer@apple.com and shipped in the upstream release before TuxCare onboarded this version. The vulnerable code pattern (missing colon validation in HttpObjectDecoder.splitHeader()) is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 affects Netty's multipart decoders which used insecure File.createTempFile() creating world-readable temp files (-rw-r--r--) allowing local users to read uploaded file content. The target version 4.1.112.Final already contains the upstream fix (commit c735357bf2) which migrated to PlatformDependent.createTempFile() that uses secure Files.createTempFile() with owner-only permissio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 affects Netty's multipart decoders which used insecure File.createTempFile() creating world-readable temp files (-rw-r--r--) allowing local users to read uploaded file content. The target version 4.1.112.Final already contains the upstream fix (commit c735357bf2) which migrated to PlatformDependent.createTempFile() that uses secure Files.createTempFile() with owner-only permissio..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.112.Final. The upstream fix (commit 07aa6b5938a8) was already included in the upstream 4.1.112.Final release that TuxCare onboarded. The fix adds two defenses: (1) OWS validation that rejects non-space/tab whitespace in header separators (HttpObjectDecoder.java:1220-1223), and (2) control character rejection in header names via token validation (HttpHe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.112.Final. The upstream fix (commit 07aa6b5938a8) was already included in the upstream 4.1.112.Final release that TuxCare onboarded. The fix adds two defenses: (1) OWS validation that rejects non-space/tab whitespace in header separators (HttpObjectDecoder.java:1220-1223), and (2) control character rejection in header names via token validation (HttpHe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is not present in the target. The vulnerable pattern (temporary file creation without owner-only permissions when directory parameter is null on Java < 7) has been fixed by upstream Netty. The fix was applied in commit 185f8b2756a (May 2022, included in Netty 4.1.77.Final) and was already present when TuxCare onboarded version 4.1.112.Final in September 2024. The fix ensures that...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 is not present in the target. The vulnerable pattern (temporary file creation without owner-only permissions when directory parameter is null on Java < 7) has been fixed by upstream Netty. The fix was applied in commit 185f8b2756a (May 2022, included in Netty 4.1.77.Final) and was already present when TuxCare onboarded version 4.1.112.Final in September 2024. The fix ensures that..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T08:55:22.236717+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via unvalidated iterator/array header values) is NOT present in target version 4.1.112.Final. The upstream fix commit fe18adff1c (applied in Netty 4.1.86.Final) is an ancestor of HEAD and was shipped in the upstream release that TuxCare onboarded. The vulnerable pattern\u2014missing validateValue() calls in setObject(Iterable) and setObject(Object...) methods\u2014...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via unvalidated iterator/array header values) is NOT present in target version 4.1.112.Final. The upstream fix commit fe18adff1c (applied in Netty 4.1.86.Final) is an ancestor of HEAD and was shipped in the upstream release that TuxCare onboarded. The vulnerable pattern\u2014missing validateValue() calls in setObject(Iterable) and setObject(Object...) methods\u2014..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T13:57:40.878166+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 (memory exhaustion via unbounded form field accumulation) is NOT present in target version 4.1.112.Final-tuxcare.6. The upstream fix (commit 0d0c6ed782 by norman_maurer@apple.com, 2024-03-21) was already included in upstream Netty 4.1.112.Final before TuxCare onboarded it (commit 66c2a8ccaa). The fix enforces hard limits on field count (default 128) and buffered bytes per field (...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-29025 (memory exhaustion via unbounded form field accumulation) is NOT present in target version 4.1.112.Final-tuxcare.6. The upstream fix (commit 0d0c6ed782 by norman_maurer@apple.com, 2024-03-21) was already included in upstream Netty 4.1.112.Final before TuxCare onboarded it (commit 66c2a8ccaa). The fix enforces hard limits on field count (default 128) and buffered bytes per field (..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.112.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.112.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.112.Final-tuxcare.6."
    }
  ]
}