{ "@id": "urn:uuid:e6d2590c-7126-449c-ae04-d556826aec51", "role": "Document Creator", "author": "https://tuxcare.com", "version": 25, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:41:00.107120+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:41:00.107120+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 does not affect this target. The vulnerability allowed HTTP headers without colons to be parsed, potentially enabling HTTP request smuggling. The upstream fix (commit a7c18d44b4 by Norman Maurer, dated 2019-12-11) was included in Netty 4.1.44. The target version 4.1.119.Final already contains this upstream fix, which was part of the release onboarded by TuxCare on 2026-08-12. The fix adds validation at HttpObjectDecoder.java:1141-1144 that rejects header lines lacking colons by throwing IllegalArgumentException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 does not affect this target. The vulnerability allowed HTTP headers without colons to be parsed, potentially enabling HTTP request smuggling. The upstream fix (commit a7c18d44b4 by Norman Maurer, dated 2019-12-11) was included in Netty 4.1.44. The target version 4.1.119.Final already contains this upstream fix, which was part of the release onboarded by TuxCare on 2026-08-12. The fix adds validation at HttpObjectDecoder.java:1141-1144 that rejects header lines lacking colons by throwing IllegalArgumentException." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Target Netty 4.1.119.Final-tuxcare.3 is NOT affected by CVE-2021-21290. The vulnerability (insecure temporary file creation with world-readable permissions in multipart decoders) was fixed in upstream commit c735357bf2 by Norman Maurer, which shipped in the 4.1.119.Final release before TuxCare's onboarding. The fix replaces File.createTempFile() with PlatformDependent.createTempFile(), which us...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 Target Netty 4.1.119.Final-tuxcare.3 is NOT affected by CVE-2021-21290. The vulnerability (insecure temporary file creation with world-readable permissions in multipart decoders) was fixed in upstream commit c735357bf2 by Norman Maurer, which shipped in the 4.1.119.Final release before TuxCare's onboarding. The fix replaces File.createTempFile() with PlatformDependent.createTempFile(), which us..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 fix was included in upstream Netty 4.1.119.Final release before TuxCare onboarding. The vulnerable pattern (silently skipping control characters in HTTP header names) is not present. The target implements validation via DefaultHttpHeadersFactory.DEFAULT_NAME_VALIDATOR which calls validateToken() to reject control characters (0x1c, 0x1d, 0x1e, 0x1f, 0x0c, and others) in header nam...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 fix was included in upstream Netty 4.1.119.Final release before TuxCare onboarding. The vulnerable pattern (silently skipping control characters in HTTP header names) is not present. The target implements validation via DefaultHttpHeadersFactory.DEFAULT_NAME_VALIDATOR which calls validateToken() to reject control characters (0x1c, 0x1d, 0x1e, 0x1f, 0x0c, and others) in header nam..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in Netty 4.1.119.Final. The vulnerability involves insecure temporary file creation in PlatformDependent.createTempFile() when directory==null on Java 6, where files were created world-readable. The fix (commit 185f8b2756) was already included in upstream release 4.1.119.Final that TuxCare onboarded. The target code at common/src/main/java/io/netty/util/internal/Pl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in Netty 4.1.119.Final. The vulnerability involves insecure temporary file creation in PlatformDependent.createTempFile() when directory==null on Java 6, where files were created world-readable. The fix (commit 185f8b2756) was already included in upstream release 4.1.119.Final that TuxCare onboarded. The target code at common/src/main/java/io/netty/util/internal/Pl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T08:53:45.706139+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is not present in target version 4.1.119.Final. The vulnerability (HTTP Response Splitting via missing header value validation in DefaultHttpHeaders.set with iterator/array arguments) was fixed in upstream commit fe18adff1c by Chris Vest (Apple) on 2022-12-12. This fix was already included in upstream Netty 4.1.119.Final when TuxCare onboarded it (commit 511e28ce70 \"Onboard versi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 is not present in target version 4.1.119.Final. The vulnerability (HTTP Response Splitting via missing header value validation in DefaultHttpHeaders.set with iterator/array arguments) was fixed in upstream commit fe18adff1c by Chris Vest (Apple) on 2022-12-12. This fix was already included in upstream Netty 4.1.119.Final when TuxCare onboarded it (commit 511e28ce70 \"Onboard versi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T13:56:56.849680+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 is NOT present in Netty 4.1.119.Final. The vulnerability pattern does not exist because the upstream fix was already included in the 4.1.119.Final release (Feb 26, 2025) when TuxCare onboarded it. The fix adds two defenses: (1) maxFields limit (default 128) preventing unbounded form field accumulation in bodyListHttpData, and (2) maxBufferedBytes limit (default 1024) preventing u...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 CVE-2024-29025 is NOT present in Netty 4.1.119.Final. The vulnerability pattern does not exist because the upstream fix was already included in the 4.1.119.Final release (Feb 26, 2025) when TuxCare onboarded it. The fix adds two defenses: (1) maxFields limit (default 128) preventing unbounded form field accumulation in bodyListHttpData, and (2) maxBufferedBytes limit (default 1024) preventing u..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42580" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55831 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56746 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59898 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59899 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59921 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.119.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }