{ "@id": "urn:uuid:ae32c025-bba7-4ecb-9b45-a55d43d4ed7a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 11, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:20:04.842645+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T07:51:59.701187+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-11-10T04:20:04.842645+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because, with default validation enabled, iterable header values pass through validation before storage. The public setters call setObject at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:175, and each element is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:485. The converter rejects unsafe line endings at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:444.", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because, with default validation enabled, iterable header values pass through validation before storage. The public setters call setObject at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:175, and each element is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:485. The converter rejects unsafe line endings at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:444." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:06:00.167611+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T07:51:59.701187+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T07:51:59.701187+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Netty 4.1.38.Final is not affected by CVE-2026-42580. This version uses Java's Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow checking and throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerable manual parsing implementation with inadequate overflow checks only exists in versions \u2265 4.1.94, where Netty refactored from String-based parsin...", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Netty 4.1.38.Final is not affected by CVE-2026-42580. This version uses Java's Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow checking and throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerable manual parsing implementation with inadequate overflow checks only exists in versions \u2265 4.1.94, where Netty refactored from String-based parsin..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T07:51:59.701187+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T07:51:59.701187+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2026-42587 describes a vulnerability where the maxAllocation parameter (introduced to prevent decompression bomb attacks) is silently ignored for Brotli, Zstd, and Snappy encodings, allowing attackers to bypass the configured memory limit. Version 4.1.38.Final is NOT AFFECTED because the maxAllocation feature does not exist in this version at all. The vulnerable code pattern (incomplete maxAllocation enforcement for non-gzip encodings) cannot exist when maxAllocation itself was not introduced until May 2025 (commit a155024263), well after the 4.1.38.Final release. This version only supports gzip/deflate decompression with no configurable memory limits. The attack chain is broken at the \"configured limit\" step - there is no configured limit to bypass.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "CVE-2026-42587 describes a vulnerability where the maxAllocation parameter (introduced to prevent decompression bomb attacks) is silently ignored for Brotli, Zstd, and Snappy encodings, allowing attackers to bypass the configured memory limit. Version 4.1.38.Final is NOT AFFECTED because the maxAllocation feature does not exist in this version at all. The vulnerable code pattern (incomplete maxAllocation enforcement for non-gzip encodings) cannot exist when maxAllocation itself was not introduced until May 2025 (commit a155024263), well after the 4.1.38.Final release. This version only supports gzip/deflate decompression with no configurable memory limits. The attack chain is broken at the \"configured limit\" step - there is no configured limit to bypass." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T07:51:59.701187+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.38.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.38.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T07:05:23.387008+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http." } ] }