{
  "@id": "urn:uuid:2e77c924-7ccb-4bbe-b904-814dc4bfa69d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T09:40:01.312839+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:40:01.312839+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in Netty 4.1.117.Final-tuxcare.4. The vulnerability allowed HTTP headers without colons to be parsed incorrectly, enabling header smuggling. The upstream fix (commit a7c18d44b46e) was already included in Netty 4.1.117.Final when TuxCare onboarded it. The defense code at HttpObjectDecoder.java:1141-1144 validates that each header line contains a colon and throws IllegalArgumentException if missing, preventing the attack.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is NOT present in Netty 4.1.117.Final-tuxcare.4. The vulnerability allowed HTTP headers without colons to be parsed incorrectly, enabling header smuggling. The upstream fix (commit a7c18d44b46e) was already included in Netty 4.1.117.Final when TuxCare onboarded it. The defense code at HttpObjectDecoder.java:1141-1144 validates that each header line contains a colon and throws IllegalArgumentException if missing, preventing the attack."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.117.Final is not affected. CVE-2021-21290 describes insecure temporary file creation in Netty's multipart decoders, where File.createTempFile() creates world-readable files (permissions -rw-r--r--) allowing local information disclosure. The vulnerability was fixed in upstream version 4.1.59.Final by replacing File.createTempFile() with PlatformDependent.createTempFile(), whic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.117.Final is not affected. CVE-2021-21290 describes insecure temporary file creation in Netty's multipart decoders, where File.createTempFile() creates world-readable files (permissions -rw-r--r--) allowing local information disclosure. The vulnerability was fixed in upstream version 4.1.59.Final by replacing File.createTempFile() with PlatformDependent.createTempFile(), whic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.117.Final-tuxcare.4) is NOT AFFECTED by CVE-2021-43797. The vulnerability pattern (silently stripping control characters and non-OWS whitespace from HTTP header names) is not present. The upstream fix commit 07aa6b5938a8b6ed7a6586e066400e2643897323 was already included in the upstream release 4.1.117.Final before TuxCare onboarded it. The fix operates at two lay...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.117.Final-tuxcare.4) is NOT AFFECTED by CVE-2021-43797. The vulnerability pattern (silently stripping control characters and non-OWS whitespace from HTTP header names) is not present. The upstream fix commit 07aa6b5938a8b6ed7a6586e066400e2643897323 was already included in the upstream release 4.1.117.Final before TuxCare onboarded it. The fix operates at two lay..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823: Target version 4.1.117.Final is NOT AFFECTED. The vulnerable temporary file creation pattern (early return when directory==null that bypassed permission restrictions) is not present. The fix by Norman Maurer (commit 185f8b2756a36aaa4f973f1a2a025e7d981823f1) was already included in the upstream 4.1.117.Final release before TuxCare onboarded it. The current code correctly ensures ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823: Target version 4.1.117.Final is NOT AFFECTED. The vulnerable temporary file creation pattern (early return when directory==null that bypassed permission restrictions) is not present. The fix by Norman Maurer (commit 185f8b2756a36aaa4f973f1a2a025e7d981823f1) was already included in the upstream 4.1.117.Final release before TuxCare onboarded it. The current code correctly ensures ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T08:56:10.810190+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target (Netty 4.1.117.Final at SHA aa9f121b73) is not affected by CVE-2022-41915. The vulnerability concerns missing header value validation in DefaultHeaders.setObject() methods when setting headers via iterators or arrays, allowing HTTP Response Splitting attacks via CRLF injection. The upstream fix (commit fe18adff1c by Chris Vest/Apple) added validateValue() calls and was included in Ne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 The target (Netty 4.1.117.Final at SHA aa9f121b73) is not affected by CVE-2022-41915. The vulnerability concerns missing header value validation in DefaultHeaders.setObject() methods when setting headers via iterators or arrays, allowing HTTP Response Splitting attacks via CRLF injection. The upstream fix (commit fe18adff1c by Chris Vest/Apple) added validateValue() calls and was included in Ne..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:00:47.374607+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 affects HttpPostRequestDecoder's unlimited data accumulation. The target (Netty 4.1.117.Final) is NOT AFFECTED because the upstream fix (commit 0d0c6ed from March 2024) was already included in the 4.1.117.Final release. The fix adds hard limits: maxFields (default 128) prevents unlimited field accumulation in bodyListHttpData, and maxBufferedBytes (default 1024) prevents unlimite...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-29025 affects HttpPostRequestDecoder's unlimited data accumulation. The target (Netty 4.1.117.Final) is NOT AFFECTED because the upstream fix (commit 0d0c6ed from March 2024) was already included in the 4.1.117.Final release. The fix adds hard limits: maxFields (default 128) prevents unlimited field accumulation in bodyListHttpData, and maxBufferedBytes (default 1024) prevents unlimite..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.117.Final-tuxcare.3."
    }
  ]
}