{
  "@id": "urn:uuid:867eeef2-59c1-4e24-a758-c7b3eb83a059",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T09:41:00.107120+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:41:00.107120+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before version 4.1.44, which allowed HTTP headers without colon separators to be parsed ambiguously. The target version 4.1.130.Final already contains the upstream fix (commit a7c18d44b4 by Norman Maurer) that validates all HTTP header lines contain a colon separator before parsing. This fix was shipped in upstream Netty 4.1.44 (December 2019) and is present in the 4.1.130.Final release that TuxCare onboarded. The vulnerable code pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty before version 4.1.44, which allowed HTTP headers without colon separators to be parsed ambiguously. The target version 4.1.130.Final already contains the upstream fix (commit a7c18d44b4 by Norman Maurer) that validates all HTTP header lines contain a colon separator before parsing. This fix was shipped in upstream Netty 4.1.44 (December 2019) and is present in the 4.1.130.Final release that TuxCare onboarded. The vulnerable code pattern is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290: Target is NOT AFFECTED. The vulnerability involves insecure temporary file creation with world-readable permissions on Unix-like systems. The upstream vendor (Norman Maurer) fixed this in February 2021 by introducing PlatformDependent.createTempFile() which uses the secure Files.createTempFile() API for Java 7+. This fix was already present in upstream netty 4.1.130.Final when T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290: Target is NOT AFFECTED. The vulnerability involves insecure temporary file creation with world-readable permissions on Unix-like systems. The upstream vendor (Norman Maurer) fixed this in February 2021 by introducing PlatformDependent.createTempFile() which uses the secure Files.createTempFile() API for Java 7+. This fix was already present in upstream netty 4.1.130.Final when T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 fix is present in Netty 4.1.130.Final. The vulnerability concerned HTTP header validation where control characters (0x1c-0x1f, 0x0c, etc.) at the beginning or end of header names were silently stripped instead of being rejected, enabling HTTP request smuggling. The upstream fix (commit 07aa6b5938a8) was included in Netty 4.1.71.Final (Dec 2021). Target version 4.1.130.Final (onbo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 fix is present in Netty 4.1.130.Final. The vulnerability concerned HTTP header validation where control characters (0x1c-0x1f, 0x0c, etc.) at the beginning or end of header names were silently stripped instead of being rejected, enabling HTTP request smuggling. The upstream fix (commit 07aa6b5938a8) was included in Netty 4.1.71.Final (Dec 2021). Target version 4.1.130.Final (onbo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in the target. The vulnerability concerned insecure temporary file creation in Netty's PlatformDependent.createTempFile() method when directory parameter is null on Java 6. The vulnerable pattern (immediate return without setting owner-only permissions) has been removed. The fix was already present in the upstream Netty 4.1.130.Final release before TuxCare onboarde...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in the target. The vulnerability concerned insecure temporary file creation in Netty's PlatformDependent.createTempFile() method when directory parameter is null on Java 6. The vulnerable pattern (immediate return without setting owner-only permissions) has been removed. The fix was already present in the upstream Netty 4.1.130.Final release before TuxCare onboarde..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T08:58:00.056889+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is not present in netty 4.1.130.Final-tuxcare.4. The vulnerability (missing validation in setObject methods with iterator/array parameters) was fixed in upstream Netty 4.1.86.Final by commit fe18adff1c (authored by Chris Vest from Apple). The target version 4.1.130.Final includes this upstream fix. Validation calls are present at codec/src/main/java/io/netty/handler/codec/Default...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 is not present in netty 4.1.130.Final-tuxcare.4. The vulnerability (missing validation in setObject methods with iterator/array parameters) was fixed in upstream Netty 4.1.86.Final by commit fe18adff1c (authored by Chris Vest from Apple). The target version 4.1.130.Final includes this upstream fix. Validation calls are present at codec/src/main/java/io/netty/handler/codec/Default..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:01:12.160119+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 describes unbounded memory accumulation in Netty's HttpPostRequestDecoder through two attack vectors: (1) unlimited fields accumulating in bodyListHttpData list, and (2) unlimited bytes buffering in undecodedChunk. The upstream fix (commit 0d0c6ed782, March 2024) added maxFields and maxBufferedBytes limits with enforcement. Target version 4.1.130.Final (released December 2025) al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-29025 describes unbounded memory accumulation in Netty's HttpPostRequestDecoder through two attack vectors: (1) unlimited fields accumulating in bodyListHttpData list, and (2) unlimited bytes buffering in undecodedChunk. The upstream fix (commit 0d0c6ed782, March 2024) added maxFields and maxBufferedBytes limits with enforcement. Target version 4.1.130.Final (released December 2025) al..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T13:47:22.731302+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 The CVE-2025-58056 vulnerability (HTTP request smuggling via improper chunk extension parsing accepting lone LF without CR) is not present in netty 4.1.130.Final-tuxcare.4. The upstream fix was already included in the netty 4.1.130.Final release that TuxCare onboarded. The fix enforces strict CRLF termination for chunk extensions and chunk delimiters, preventing the message boundary confusion t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "impact_statement": "not_affected \u2014 The CVE-2025-58056 vulnerability (HTTP request smuggling via improper chunk extension parsing accepting lone LF without CR) is not present in netty 4.1.130.Final-tuxcare.4. The upstream fix was already included in the netty 4.1.130.Final release that TuxCare onboarded. The fix enforces strict CRLF termination for chunk extensions and chunk delimiters, preventing the message boundary confusion t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T13:51:22.372983+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 The target version 4.1.130.Final is not affected by CVE-2025-67735 (CRLF injection in HTTP URIs leading to request smuggling). The upstream Netty project fixed this vulnerability in commit 77e81f1e59 (authored by Chris Vest <christianvest_hansen@apple.com>) before the 4.1.130.Final release. When TuxCare onboarded version 4.1.130.Final (commit c7c85999934 by evasilev@cloudlinux.com), the fix was...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "impact_statement": "not_affected \u2014 The target version 4.1.130.Final is not affected by CVE-2025-67735 (CRLF injection in HTTP URIs leading to request smuggling). The upstream Netty project fixed this vulnerability in commit 77e81f1e59 (authored by Chris Vest <christianvest_hansen@apple.com>) before the 4.1.130.Final release. When TuxCare onboarded version 4.1.130.Final (commit c7c85999934 by evasilev@cloudlinux.com), the fix was..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.130.Final-tuxcare.3."
    }
  ]
}