{
  "@id": "urn:uuid:58d60afa-5c6d-428a-a5e9-a4f72fc71c9b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T09:40:01.312839+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:40:01.312839+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 is NOT affecting this target. The vulnerability involves HTTP header parsing that accepts header lines without colons, potentially causing HTTP message structure disagreement between components. The upstream vendor (Norman Maurer) fixed this in commit a7c18d44b4 by adding validation that rejects headers lacking colons. This fix was already present in the upstream Netty 4.1.115.Final release that TuxCare onboarded, predating the first TuxCare commit (6d8479fcc0). The defense code is confirmed present at HttpObjectDecoder.java:1121-1124, which throws IllegalArgumentException when no colon is found in a header line.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is NOT affecting this target. The vulnerability involves HTTP header parsing that accepts header lines without colons, potentially causing HTTP message structure disagreement between components. The upstream vendor (Norman Maurer) fixed this in commit a7c18d44b4 by adding validation that rejects headers lacking colons. This fix was already present in the upstream Netty 4.1.115.Final release that TuxCare onboarded, predating the first TuxCare commit (6d8479fcc0). The defense code is confirmed present at HttpObjectDecoder.java:1121-1124, which throws IllegalArgumentException when no colon is found in a header line."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.115.Final already contains the fix for CVE-2021-21290. The vulnerable pattern (insecure temp file creation with world-readable permissions) is not present because the upstream fix shipped in Netty 4.1.59.Final (February 2021) and was included in the 4.1.115.Final release that TuxCare onboarded. The code uses PlatformDependent.createTempFile() which implements secure file perm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.115.Final already contains the fix for CVE-2021-21290. The vulnerable pattern (insecure temp file creation with world-readable permissions) is not present because the upstream fix shipped in Netty 4.1.59.Final (February 2021) and was included in the 4.1.115.Final release that TuxCare onboarded. The code uses PlatformDependent.createTempFile() which implements secure file perm..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.115.Final-tuxcare.13. The vulnerability involved silent sanitization of control characters (0x00-0x1f) in HTTP header names, enabling request smuggling when Netty acts as a proxy. The fix (upstream commit 07aa6b5938) shipped with Netty 4.1.115.Final on 2024-11-12, before any TuxCare modifications. The target implements the fix in refactored form: contr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.115.Final-tuxcare.13. The vulnerability involved silent sanitization of control characters (0x00-0x1f) in HTTP header names, enabling request smuggling when Netty acts as a proxy. The fix (upstream commit 07aa6b5938) shipped with Netty 4.1.115.Final on 2024-11-12, before any TuxCare modifications. The target implements the fix in refactored form: contr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 describes an insufficient fix for CVE-2021-21290 where temporary files created by netty's multipart decoders on Java 6 and lower were world-readable. The vulnerable code path was: `if (directory == null) { return File.createTempFile(prefix, suffix); }` which returned without setting permissions. The target repository version 4.1.115.Final already contains the complete fix from up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 describes an insufficient fix for CVE-2021-21290 where temporary files created by netty's multipart decoders on Java 6 and lower were world-readable. The vulnerable code path was: `if (directory == null) { return File.createTempFile(prefix, suffix); }` which returned without setting permissions. The target repository version 4.1.115.Final already contains the complete fix from up..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T08:51:23.373726+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via missing validation in DefaultHttpHeaders.set() with iterator/array parameters) is NOT present in the target. The upstream vendor fix (commit fe18adff1c by Chris Vest @apple.com) was already included in Netty 4.1.86.Final, which predates the 4.1.115.Final release that TuxCare onboarded. The required validateValue() calls are present in both setObject()...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via missing validation in DefaultHttpHeaders.set() with iterator/array parameters) is NOT present in the target. The upstream vendor fix (commit fe18adff1c by Chris Vest @apple.com) was already included in Netty 4.1.86.Final, which predates the 4.1.115.Final release that TuxCare onboarded. The required validateValue() calls are present in both setObject()..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T13:55:26.386665+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 is NOT present in Netty 4.1.115.Final-tuxcare.13. The vulnerability (unlimited memory accumulation in HttpPostRequestDecoder via unbounded field counts and buffer sizes) was fixed in upstream Netty commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c by Norman Maurer, which shipped in the upstream 4.1.115.Final release that TuxCare onboarded. The fix adds two hard limits with default ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-29025 is NOT present in Netty 4.1.115.Final-tuxcare.13. The vulnerability (unlimited memory accumulation in HttpPostRequestDecoder via unbounded field counts and buffer sizes) was fixed in upstream Netty commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c by Norman Maurer, which shipped in the upstream 4.1.115.Final release that TuxCare onboarded. The fix adds two hard limits with default ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T01:17:00.135394+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T22:48:24.591646+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.12.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.12."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.115.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.115.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.115.Final-tuxcare.8."
    }
  ]
}