{ "@id": "urn:uuid:03b0ad88-f405-4790-b52e-eb8c8a5125d2", "role": "Document Creator", "author": "https://tuxcare.com", "version": 13, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:51:00.040518+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:42.862061+00:00", "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2021-43797" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T04:19:00.046039+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default validation blocks header-injection values before storage. Multi-value setters validate each element through a converter before insertion in codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:485. The converter rejects trailing carriage returns or line feeds and requires whitespace after a line feed, blocking injected headers in codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:499.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default validation blocks header-injection values before storage. Multi-value setters validate each element through a converter before insertion in codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:485. The converter rejects trailing carriage returns or line feeds and requires whitespace after a line feed, blocking injected headers in codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:499." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T08:49:00.067110+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T08:49:00.067110+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 Version 4.1.43.Final is NOT affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow detection per Java Language Specification. The vulnerable manual parsing code (result *= 16; result += digit with only negative overflow checking) was introduced later in version 4.1.88.Final as a performance optimization. When the CVE PoC value...", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Version 4.1.43.Final is NOT affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow detection per Java Language Specification. The vulnerable manual parsing code (result *= 16; result += digit with only negative overflow checking) was introduced later in version 4.1.88.Final as a performance optimization. When the CVE PoC value..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T08:49:00.067110+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T08:49:00.067110+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http. Version 4.1.43.Final does not support brotli, zstd, or snappy HTTP content decompression. The vulnerable code path described in CVE-2026-42587 (HttpContentDecompressor/DelegatingDecompressorFrameListener accepting maxAllocation but ignoring it for br/zstd/snappy encodings) does not exist in this version. Both HTTP/1.1 and HTTP/2 decompressors only support gzip and deflate encodings, returning null for br/zstd/snappy. When a request with Content-Encoding: br/zstd/snappy is received, no decompression occurs, preventing unbounded memory allocation. The decoders for these formats were added in later versions (after 4.1.43.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Version 4.1.43.Final does not support brotli, zstd, or snappy HTTP content decompression. The vulnerable code path described in CVE-2026-42587 (HttpContentDecompressor/DelegatingDecompressorFrameListener accepting maxAllocation but ignoring it for br/zstd/snappy encodings) does not exist in this version. Both HTTP/1.1 and HTTP/2 decompressors only support gzip and deflate encodings, returning null for br/zstd/snappy. When a request with Content-Encoding: br/zstd/snappy is received, no decompression occurs, preventing unbounded memory allocation. The decoders for these formats were added in later versions (after 4.1.43.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T08:49:00.067110+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.43.Final-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.43.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:19:34.539452+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.43.Final-tuxcare.4 of io.netty:netty-codec-http." } ] }