{
  "@id": "urn:uuid:9d54c005-6cec-489a-ac4e-ebed8a1ea48e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:20:04.842645+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:55:41.957093+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2019-20444"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T18:15:10.561676+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:20:04.842645+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default header validation blocks response-splitting payloads in multi-value setters. Each value passes through a converter before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:485. The validating converter rejects trailing CR/LF and line breaks followed by a new header name at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:444 and :487.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default header validation blocks response-splitting payloads in multi-value setters. Each value passes through a converter before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:485. The validating converter rejects trailing CR/LF and line breaks followed by a new header name at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:444 and :487."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:55:41.957093+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:38:00.043306+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:38:00.043306+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.42.Final is NOT AFFECTED by CVE-2026-42580. The target uses a fundamentally different chunk size parsing implementation than the vulnerable upstream code. While upstream versions manually parse hex bytes with inadequate overflow checking (result *= 16; result += digit; if (result < 0)), the target delegates to Java's standard Integer.parseInt(hex, 16), which has built-in over...",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.42.Final is NOT AFFECTED by CVE-2026-42580. The target uses a fundamentally different chunk size parsing implementation than the vulnerable upstream code. While upstream versions manually parse hex bytes with inadequate overflow checking (result *= 16; result += digit; if (result < 0)), the target delegates to Java's standard Integer.parseInt(hex, 16), which has built-in over..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:38:00.043306+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:38:00.043306+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http. Version 4.1.42.Final is NOT affected by CVE-2026-42587. The vulnerability concerns BrotliDecoder, ZstdDecoder, and SnappyFrameDecoder ignoring the maxAllocation parameter for decompression bomb protection. However, these decoders and their corresponding Content-Encoding support (br, zstd, snappy) do NOT exist in this version. Both HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip and deflate encodings, returning null for unsupported encodings. The compressed input types described in the CVE are not processed by this version, so the vulnerability cannot manifest. Brotli, Zstd, and Snappy support were added in much later versions (post-4.1.42).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Version 4.1.42.Final is NOT affected by CVE-2026-42587. The vulnerability concerns BrotliDecoder, ZstdDecoder, and SnappyFrameDecoder ignoring the maxAllocation parameter for decompression bomb protection. However, these decoders and their corresponding Content-Encoding support (br, zstd, snappy) do NOT exist in this version. Both HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip and deflate encodings, returning null for unsupported encodings. The compressed input types described in the CVE are not processed by this version, so the vulnerability cannot manifest. Brotli, Zstd, and Snappy support were added in much later versions (post-4.1.42)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:38:00.043306+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.42.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-codec-http."
    }
  ]
}