{ "@id": "urn:uuid:329e23a7-695f-4f66-926b-c8d994fccf7d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 24, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:40:01.312839+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:40:01.312839+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in the target. The vulnerability concerns missing validation for HTTP headers lacking a colon separator, which could be interpreted as invalid header folds or malformed headers. The fix (checking if nameEnd == end and throwing IllegalArgumentException) was introduced in upstream Netty 4.1.44 by Norman Maurer. The target repository is based on Netty 4.1.114.Final, which already includes this fix from upstream. The fix was present when TuxCare onboarded version 4.1.114.Final, making this an upstream-provided fix rather than a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 is NOT present in the target. The vulnerability concerns missing validation for HTTP headers lacking a colon separator, which could be interpreted as invalid header folds or malformed headers. The fix (checking if nameEnd == end and throwing IllegalArgumentException) was introduced in upstream Netty 4.1.44 by Norman Maurer. The target repository is based on Netty 4.1.114.Final, which already includes this fix from upstream. The fix was present when TuxCare onboarded version 4.1.114.Final, making this an upstream-provided fix rather than a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is NOT present in netty 4.1.114.Final. The vulnerability involved insecure temporary file creation with world-readable permissions (-rw-r--r--) when handling multipart HTTP uploads. The upstream fix replaced File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.createTempFile() on Java 7+ to create files with secure owner-only permissions. This fix was i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 CVE-2021-21290 is NOT present in netty 4.1.114.Final. The vulnerability involved insecure temporary file creation with world-readable permissions (-rw-r--r--) when handling multipart HTTP uploads. The upstream fix replaced File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.createTempFile() on Java 7+ to create files with secure owner-only permissions. This fix was i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.114.Final) is NOT AFFECTED by CVE-2021-43797. The vulnerability fix was already present in the upstream Netty 4.1.114.Final release that TuxCare onboarded. The fix commit (07aa6b5938a by Norman Maurer, 2021-12-09) is an ancestor of both the onboarding commit and HEAD. The vulnerable pattern (accepting control characters in header names and skipping validation) d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.114.Final) is NOT AFFECTED by CVE-2021-43797. The vulnerability fix was already present in the upstream Netty 4.1.114.Final release that TuxCare onboarded. The fix commit (07aa6b5938a by Norman Maurer, 2021-12-09) is an ancestor of both the onboarding commit and HEAD. The vulnerable pattern (accepting control characters in header names and skipping validation) d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target (Netty 4.1.114.Final-tuxcare.2) is not affected by CVE-2022-24823. The vulnerability involved insecure temporary file creation on Java 6 systems where the null-directory code path failed to set restrictive permissions. The upstream fix (commit 185f8b2756a by Norman Maurer) was already included in Netty 4.1.114.Final when TuxCare onboarded it. The fix ensures both createTempFile code ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 The target (Netty 4.1.114.Final-tuxcare.2) is not affected by CVE-2022-24823. The vulnerability involved insecure temporary file creation on Java 6 systems where the null-directory code path failed to set restrictive permissions. The upstream fix (commit 185f8b2756a by Norman Maurer) was already included in Netty 4.1.114.Final when TuxCare onboarded it. The fix ensures both createTempFile code ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T08:53:00.046847+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target (Netty 4.1.114.Final-tuxcare.2) is NOT vulnerable to CVE-2022-41915. The upstream fix (commit fe18adff1c by Chris Vest) was already present in Netty 4.1.114.Final when TuxCare onboarded it. The vulnerable pattern\u2014missing validation in DefaultHeaders.setObject() methods when values are passed via iterator or array\u2014is not present. Both setObject(Iterable) and setObject(Object[]) method...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 The target (Netty 4.1.114.Final-tuxcare.2) is NOT vulnerable to CVE-2022-41915. The upstream fix (commit fe18adff1c by Chris Vest) was already present in Netty 4.1.114.Final when TuxCare onboarded it. The vulnerable pattern\u2014missing validation in DefaultHeaders.setObject() methods when values are passed via iterator or array\u2014is not present. Both setObject(Iterable) and setObject(Object[]) method..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T13:53:01.132395+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 is not present in Netty 4.1.114.Final. The upstream Netty project fixed this vulnerability in commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c (authored by Norman Maurer on March 21, 2024), and that fix was already included in the upstream 4.1.114.Final release that TuxCare onboarded. The target code contains all defensive measures from the upstream patch: DEFAULT_MAX_FIELDS (128)...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 CVE-2024-29025 is not present in Netty 4.1.114.Final. The upstream Netty project fixed this vulnerability in commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c (authored by Norman Maurer on March 21, 2024), and that fix was already included in the upstream 4.1.114.Final release that TuxCare onboarded. The target code contains all defensive measures from the upstream patch: DEFAULT_MAX_FIELDS (128)..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T08:49:00.071900+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.114.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.114.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T08:49:00.071900+00:00", "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.114.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2026-42580" }, "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.114.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T08:49:00.071900+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.114.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.114.Final-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" }, "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T08:49:00.071900+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.114.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.114.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.114.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:32:48.777555+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http." } ] }