{
  "@id": "urn:uuid:711f92ad-fd9c-4558-8980-d30093d033cd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T11:24:00.030830+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 is not present in Netty 4.1.64.Final. The vulnerability affects Netty versions before 4.1.44, and the target version (4.1.64.Final) already contains the upstream fix (commit a7c18d44) that validates HTTP headers must contain a colon separator. The fix was shipped in the upstream release 4.1.64.Final before TuxCare onboarding, making this an upstream-resolved issue.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is not present in Netty 4.1.64.Final. The vulnerability affects Netty versions before 4.1.44, and the target version (4.1.64.Final) already contains the upstream fix (commit a7c18d44) that validates HTTP headers must contain a colon separator. The fix was shipped in the upstream release 4.1.64.Final before TuxCare onboarding, making this an upstream-resolved issue."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 affects Netty's multipart decoders when creating temporary files with insecure permissions on Unix-like systems. The target (version 4.1.64.Final) is NOT AFFECTED because the vulnerability pattern is not present. The upstream fix (commit c735357bf2 by Norman Maurer) replaced File.createTempFile() with PlatformDependent.createTempFile() which uses Files.createTempFile() on Java 7+...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 affects Netty's multipart decoders when creating temporary files with insecure permissions on Unix-like systems. The target (version 4.1.64.Final) is NOT AFFECTED because the vulnerability pattern is not present. The upstream fix (commit c735357bf2 by Norman Maurer) replaced File.createTempFile() with PlatformDependent.createTempFile() which uses Files.createTempFile() on Java 7+..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 is fixed in version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:19:00.046039+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default header validation blocks response-splitting values before insertion. The collection setter calls setObject at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:188, and its loop converts each non-null value at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:495. The converter rejects trailing CR/LF or a new header following CRLF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:499.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default header validation blocks response-splitting values before insertion. The collection setter calls setObject at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:188, and its loop converts each non-null value at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:495. The converter rejects trailing CR/LF or a new header following CRLF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:499."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Version 4.1.64.Final is not affected by CVE-2026-42580. The vulnerable code pattern (manual int accumulation in byte[]-based chunk size parsing that silently overflows) does not exist in this version. Version 4.1.64.Final uses String-based Integer.parseInt(hex, 16) which has built-in overflow validation and throws NumberFormatException when chunk size exceeds Integer.MAX_VALUE. The vulnerable b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.64.Final is not affected by CVE-2026-42580. The vulnerable code pattern (manual int accumulation in byte[]-based chunk size parsing that silently overflows) does not exist in this version. Version 4.1.64.Final uses String-based Integer.parseInt(hex, 16) which has built-in overflow validation and throws NumberFormatException when chunk size exceeds Integer.MAX_VALUE. The vulnerable b..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-12T11:24:00.030830+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.64.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.64.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.64.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:32:49.374995+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.64.Final-tuxcare.2 of io.netty:netty-codec-http."
    }
  ]
}