{ "@id": "urn:uuid:359c7324-5875-454a-8d60-a5c83c513d02", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:05:51.407283+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:37:32.916607+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in target Netty 4.1.53.Final. The vulnerability (accepting HTTP headers without colons) was fixed in upstream commit a7c18d44b46e02dadfe3da225a06e5091f5f328e by Norman Maurer, which shipped in upstream release 4.1.44. Since target version 4.1.53.Final is after 4.1.44, the fix was already included when TuxCare onboarded this version via commit cc0d751b793bc5ebf1a97f1172ec8cd2f75eeb9b. The defense at HttpObjectDecoder.java:893-896 detects headers lacking colons and throws IllegalArgumentException, preventing header injection attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 is NOT present in target Netty 4.1.53.Final. The vulnerability (accepting HTTP headers without colons) was fixed in upstream commit a7c18d44b46e02dadfe3da225a06e5091f5f328e by Norman Maurer, which shipped in upstream release 4.1.44. Since target version 4.1.53.Final is after 4.1.44, the fix was already included when TuxCare onboarded this version via commit cc0d751b793bc5ebf1a97f1172ec8cd2f75eeb9b. The defense at HttpObjectDecoder.java:893-896 detects headers lacking colons and throws IllegalArgumentException, preventing header injection attacks." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2021-21290" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2021-43797" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-11-10T04:18:27.575491+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because validation enabled by default blocks response-splitting values before storage. Each iterable value is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:485. The validating converter checks every character and rejects terminal CR/LF and new header text after LF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:456 and codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:499.", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because validation enabled by default blocks response-splitting values before storage. Each iterable value is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:485. The validating converter checks every character and rejects terminal CR/LF and new header text after LF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:456 and codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:499." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" }, "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Netty 4.1.53.Final is not affected by CVE-2026-42580. The vulnerable code pattern (manual chunk size parsing with inadequate overflow check) was introduced in upstream commit 60e53c99 (March 2026), well after this version's release (October 2020). The target uses Java's Integer.parseInt(hex, 16) which has built-in overflow validation that throws NumberFormatException for values exceeding Intege...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Netty 4.1.53.Final is not affected by CVE-2026-42580. The vulnerable code pattern (manual chunk size parsing with inadequate overflow check) was introduced in upstream commit 60e53c99 (March 2026), well after this version's release (October 2020). The target uses Java's Integer.parseInt(hex, 16) which has built-in overflow validation that throws NumberFormatException for values exceeding Intege..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T09:27:26.936719+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.53.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.53.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-11-08T19:32:41.199787+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.53.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.53.Final-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http. Version 4.1.53.Final (September 2020) does not contain the vulnerable code pattern described in CVE-2026-42587. The CVE describes a vulnerability where HttpContentDecompressor's maxAllocation parameter is not passed to BrotliDecoder, ZstdDecoder, and SnappyFrameDecoder, allowing decompression bomb attacks via br/zstd/snappy encodings. However, this version predates the vulnerable code by 3-5 years: brotli/zstd/snappy decompression support was added in 2023-2024, the maxAllocation parameter was added in 2025, and the CVE was fixed in 2026. In version 4.1.53.Final, HttpContentDecompressor.newContentDecoder() only handles gzip and deflate encodings (lines 54-70), returning null for all other encodings including br/zstd/snappy. No code path exists to decompress these formats, making the attack described in the CVE impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Version 4.1.53.Final (September 2020) does not contain the vulnerable code pattern described in CVE-2026-42587. The CVE describes a vulnerability where HttpContentDecompressor's maxAllocation parameter is not passed to BrotliDecoder, ZstdDecoder, and SnappyFrameDecoder, allowing decompression bomb attacks via br/zstd/snappy encodings. However, this version predates the vulnerable code by 3-5 years: brotli/zstd/snappy decompression support was added in 2023-2024, the maxAllocation parameter was added in 2025, and the CVE was fixed in 2026. In version 4.1.53.Final, HttpContentDecompressor.newContentDecoder() only handles gzip and deflate encodings (lines 54-70), returning null for all other encodings including br/zstd/snappy. No code path exists to decompress these formats, making the attack described in the CVE impossible." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T09:27:26.936719+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.53.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.53.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.53.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T19:12:23.415387+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.53.Final-tuxcare.2 of io.netty:netty-codec-http." } ] }