{
  "@id": "urn:uuid:6ab20e8f-ee89-4b0d-a38e-30cb0f545fc4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T09:37:56.546685+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in Netty 4.1.63.Final. The vulnerability affects Netty before version 4.1.44. The target version (4.1.63.Final) already contains the upstream fix (commit a7c18d44b4) authored by Norman Maurer that was shipped in the upstream release. The fix adds validation in HttpObjectDecoder.splitHeader() to detect and reject HTTP header lines that completely lack a colon character, preventing header parsing confusion attacks.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is NOT present in Netty 4.1.63.Final. The vulnerability affects Netty before version 4.1.44. The target version (4.1.63.Final) already contains the upstream fix (commit a7c18d44b4) authored by Norman Maurer that was shipped in the upstream release. The fix adds validation in HttpObjectDecoder.splitHeader() to detect and reject HTTP header lines that completely lack a colon character, preventing header parsing confusion attacks."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is not present in Netty 4.1.63.Final. The vulnerability concerns insecure temporary file creation with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData when processing multipart HTTP uploads. The fix (replacing File.createTempFile() with PlatformDependent.createTempFile() which uses Files.createTempFile() on Java 7+ or explicit permission adjustment on Java 6) was ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is not present in Netty 4.1.63.Final. The vulnerability concerns insecure temporary file creation with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData when processing multipart HTTP uploads. The fix (replacing File.createTempFile() with PlatformDependent.createTempFile() which uses Files.createTempFile() on Java 7+ or explicit permission adjustment on Java 6) was ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 is fixed in version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 is fixed in version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:19:07.423599+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.63.Final-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-29T13:11:23.216651+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.63.Final-tuxcare.8 of io.netty:netty-codec-http."
    }
  ]
}