{
  "@id": "urn:uuid:21f6c2b0-ac81-4820-ade1-607b88a0804d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T07:44:30.966735+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:37:32.916607+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before 4.1.44 by allowing HTTP headers without colons, potentially enabling header smuggling. The target version 4.1.48.Final already includes the upstream fix (commit a7c18d44b46e) which validates header format and rejects headers lacking colons. The fix was shipped in the upstream Netty 4.1.48.Final release and is present at HttpObjectDecoder.java lines 868-871. The vulnerable pattern is not present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty before 4.1.44 by allowing HTTP headers without colons, potentially enabling header smuggling. The target version 4.1.48.Final already includes the upstream fix (commit a7c18d44b46e) which validates header format and rejects headers lacking colons. The fix was shipped in the upstream Netty 4.1.48.Final release and is present at HttpObjectDecoder.java lines 868-871. The vulnerable pattern is not present in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T23:12:13.809981+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:22:08.408592+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 is fixed in version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T23:12:13.809981+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:23:00.134646+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T06:32:00.049775+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T06:32:00.049775+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T06:32:00.049775+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T07:44:30.966735+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T06:32:00.049775+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.48.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.48.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T12:17:06.954676+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.4 of io.netty:netty-codec-http."
    }
  ]
}