{ "@id": "urn:uuid:d0ae8f53-798f-4c17-ac18-6eb533db1d9f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-08T18:17:28.576889+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-05T09:41:00.107120+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in Netty 4.1.128.Final. The vulnerability affected Netty versions before 4.1.44, where HttpObjectDecoder allowed HTTP header lines without colons, potentially enabling header injection attacks. The upstream fix (commit a7c18d44b46e02dadfe3da225a06e5091f5f328e by Norman Maurer, Dec 2019) was already included in Netty 4.1.128.Final when TuxCare onboarded it. The fix validates that each header line contains a colon and throws IllegalArgumentException if missing, preventing the vulnerable pattern. Target version 4.1.128.Final is 84 minor versions newer than the fix version 4.1.44, confirming the fix shipped with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 is NOT present in Netty 4.1.128.Final. The vulnerability affected Netty versions before 4.1.44, where HttpObjectDecoder allowed HTTP header lines without colons, potentially enabling header injection attacks. The upstream fix (commit a7c18d44b46e02dadfe3da225a06e5091f5f328e by Norman Maurer, Dec 2019) was already included in Netty 4.1.128.Final when TuxCare onboarded it. The fix validates that each header line contains a colon and throws IllegalArgumentException if missing, preventing the vulnerable pattern. Target version 4.1.128.Final is 84 minor versions newer than the fix version 4.1.44, confirming the fix shipped with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.128.Final-tuxcare.2) is NOT affected by CVE-2021-21290. The vulnerable code pattern (using File.createTempFile() directly in multipart decoders, which creates world-readable temporary files on Unix-like systems) is not present. The fix was already included in the upstream Netty 4.1.128.Final release when TuxCare onboarded it. The CVE was fixed in upstream versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.128.Final-tuxcare.2) is NOT affected by CVE-2021-21290. The vulnerable code pattern (using File.createTempFile() directly in multipart decoders, which creates world-readable temporary files on Unix-like systems) is not present. The fix was already included in the upstream Netty 4.1.128.Final release when TuxCare onboarded it. The CVE was fixed in upstream versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.128.Final. The upstream fix (commit 07aa6b5938 by Norman Maurer, December 2021) was included in netty-4.1.71.Final and all subsequent releases. The target version (4.1.128.Final, released 2025) is 57 versions newer and contains the complete fix. The defense validates all header names using HttpUtil.isValidTokenChar(), which rejects whitespace and contr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.128.Final. The upstream fix (commit 07aa6b5938 by Norman Maurer, December 2021) was included in netty-4.1.71.Final and all subsequent releases. The target version (4.1.128.Final, released 2025) is 57 versions newer and contains the complete fix. The defense validates all header names using HttpUtil.isValidTokenChar(), which rejects whitespace and contr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in netty 4.1.128.Final. The vulnerability affected the PlatformDependent.createTempFile() method where the directory==null code path created world-readable temporary files without applying permission restrictions. The fix (commit 185f8b2756) was released in netty 4.1.77.Final (May 2022) and is present in the target version 4.1.128.Final. This is an upstream fix aut...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in netty 4.1.128.Final. The vulnerability affected the PlatformDependent.createTempFile() method where the directory==null code path created world-readable temporary files without applying permission restrictions. The fix (commit 185f8b2756) was released in netty 4.1.77.Final (May 2022) and is present in the target version 4.1.128.Final. This is an upstream fix aut..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is NOT present in Netty 4.1.128.Final-tuxcare.2. The vulnerability involved missing header value validation in DefaultHeaders.setObject() methods when accepting iterators or arrays, allowing HTTP Response Splitting via CRLF injection. The fix (adding validateValue calls on lines 490, 510, 536, 556) was shipped in upstream Netty 4.1.86.Final and is present in this version. The fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 is NOT present in Netty 4.1.128.Final-tuxcare.2. The vulnerability involved missing header value validation in DefaultHeaders.setObject() methods when accepting iterators or arrays, allowing HTTP Response Splitting via CRLF injection. The fix (adding validateValue calls on lines 490, 510, 536, 556) was shipped in upstream Netty 4.1.86.Final and is present in this version. The fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 The target repository at version 4.1.128.Final is NOT AFFECTED by CVE-2024-29025. The vulnerability (unbounded memory accumulation in HttpPostRequestDecoder through unlimited field count and per-field buffering) was fixed in upstream Netty commit 0d0c6ed by Norman Maurer (Apple). This fix was already present in the upstream 4.1.128.Final release when TuxCare onboarded it. The fix introduces two...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 The target repository at version 4.1.128.Final is NOT AFFECTED by CVE-2024-29025. The vulnerability (unbounded memory accumulation in HttpPostRequestDecoder through unlimited field count and per-field buffering) was fixed in upstream Netty commit 0d0c6ed by Norman Maurer (Apple). This fix was already present in the upstream 4.1.128.Final release when TuxCare onboarded it. The fix introduces two..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2025-58056 does not affect version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.128.Final is not affected by CVE-2025-58056. The vulnerability (request smuggling via lenient chunk extension parsing) was fixed in upstream netty 4.1.125.Final by commit 39d3ecf8f0c (authored by Chris Vest). The fix enforces strict CRLF termination for chunk-size lines and chunk delimiters, rejecting lone LF octets. This upstream fix shipped in the 4.1.125.Final release and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58056" }, "impact_statement": "not_affected \u2014 Target version 4.1.128.Final is not affected by CVE-2025-58056. The vulnerability (request smuggling via lenient chunk extension parsing) was fixed in upstream netty 4.1.125.Final by commit 39d3ecf8f0c (authored by Chris Vest). The fix enforces strict CRLF termination for chunk-size lines and chunk delimiters, rejecting lone LF octets. This upstream fix shipped in the 4.1.125.Final release and ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42580" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-08T18:17:28.576889+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.128.Final-tuxcare.4.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.128.Final-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.128.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:32:51.094741+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.3 of io.netty:netty-codec-http." } ] }