{ "@id": "urn:uuid:7cdba1a8-093d-4a01-8013-31c6a630acf9", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:20:04.842645+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in the target. The vulnerability pattern (accepting HTTP headers without colons) was removed by upstream commit a7c18d44b46e02dadfe3da225a06e5091f5f328e (Norman Maurer, 2019-12-11), which was already included in Netty 4.1.46.Final before TuxCare onboarded this version. The fix adds validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException(\"No colon found\") when a header line contains no colon character, preventing malformed headers from being accepted and processed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 is NOT present in the target. The vulnerability pattern (accepting HTTP headers without colons) was removed by upstream commit a7c18d44b46e02dadfe3da225a06e5091f5f328e (Norman Maurer, 2019-12-11), which was already included in Netty 4.1.46.Final before TuxCare onboarded this version. The fix adds validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException(\"No colon found\") when a header line contains no colon character, preventing malformed headers from being accepted and processed." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2021-43797" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-10T04:20:04.842645+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because header values are validated by default before storage, blocking the described response-splitting payload. Each iterable value passes through the converter at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:492, and the validating converter rejects the injected header after a line break at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:506.", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because header values are validated by default before storage, blocking the described response-splitting payload. Each iterable value passes through the converter at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:492, and the validating converter rejects the injected header after a line break at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:506." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Version 4.1.46.Final is not affected by CVE-2026-42580. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow protection and throws NumberFormatException when values exceed Integer.MAX_VALUE. The vulnerable code pattern (manual accumulation with result *= 16; result += digit; and insufficient overflow checking) was not introduced until January 2023 (commi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Version 4.1.46.Final is not affected by CVE-2026-42580. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow protection and throws NumberFormatException when values exceed Integer.MAX_VALUE. The vulnerable code pattern (manual accumulation with result *= 16; result += digit; and insufficient overflow checking) was not introduced until January 2023 (commi..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http. Netty 4.1.46.Final is not affected by CVE-2026-42587. The vulnerability describes a bypass where attackers can circumvent a configured maxAllocation limit by switching from Content-Encoding: gzip to Content-Encoding: br/zstd/snappy. This version predates the vulnerable feature entirely: (1) HttpContentDecompressor has no maxAllocation parameter, (2) Brotli/Zstd/Snappy encodings are not supported in HTTP decompressors, (3) requests with these encodings are passed through without decompression. The specific bypass attack path described in the CVE cannot exist because the target code neither accepts these content encodings nor exposes the maxAllocation API. The vulnerable code pattern was introduced in later commits (a155024263 and 51260aa57e) that are not ancestors of this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Netty 4.1.46.Final is not affected by CVE-2026-42587. The vulnerability describes a bypass where attackers can circumvent a configured maxAllocation limit by switching from Content-Encoding: gzip to Content-Encoding: br/zstd/snappy. This version predates the vulnerable feature entirely: (1) HttpContentDecompressor has no maxAllocation parameter, (2) Brotli/Zstd/Snappy encodings are not supported in HTTP decompressors, (3) requests with these encodings are passed through without decompression. The specific bypass attack path described in the CVE cannot exist because the target code neither accepts these content encodings nor exposes the maxAllocation API. The vulnerable code pattern was introduced in later commits (a155024263 and 51260aa57e) that are not ancestors of this version." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:50:00.057997+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.46.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T18:48:34.594294+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http." } ] }