{
  "@id": "urn:uuid:d7ca80d0-d90e-4d85-bb36-9bd39b38b025",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:38:22.324796+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http. The target Netty 4.1.72.Final is NOT affected by CVE-2019-20444. The vulnerability (missing colon validation in HTTP header parsing) was fixed in upstream Netty 4.1.44 by commit a7c18d44b4 (authored by Norman Maurer). This fix was already present in the upstream 4.1.72.Final release that TuxCare onboarded. The splitHeader method at line 950-953 of HttpObjectDecoder.java contains the required validation: \"if (nameEnd == length) { throw new IllegalArgumentException('No colon found'); }\" which prevents malformed headers without colons from being misinterpreted.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "The target Netty 4.1.72.Final is NOT affected by CVE-2019-20444. The vulnerability (missing colon validation in HTTP header parsing) was fixed in upstream Netty 4.1.44 by commit a7c18d44b4 (authored by Norman Maurer). This fix was already present in the upstream 4.1.72.Final release that TuxCare onboarded. The splitHeader method at line 950-953 of HttpObjectDecoder.java contains the required validation: \"if (nameEnd == length) { throw new IllegalArgumentException('No colon found'); }\" which prevents malformed headers without colons from being misinterpreted."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 concerns insecure temporary file creation in Netty's multipart decoders using File.createTempFile(), which creates files with world-readable permissions (-rw-r--r--) on Unix-like systems, allowing local users to read sensitive uploaded data. The target version 4.1.72.Final-tuxcare.1 is NOT affected because the fix was already present in upstream Netty 4.1.72.Final (released Decem...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 concerns insecure temporary file creation in Netty's multipart decoders using File.createTempFile(), which creates files with world-readable permissions (-rw-r--r--) on Unix-like systems, allowing local users to read sensitive uploaded data. The target version 4.1.72.Final-tuxcare.1 is NOT affected because the fix was already present in upstream Netty 4.1.72.Final (released Decem..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.72.Final. The vulnerability (silent sanitization of control characters in HTTP header names leading to request smuggling) was fixed in upstream commit 07aa6b5938a8 on Dec 9, 2021. Netty 4.1.72.Final was released on Dec 10, 2021 and already contained this fix. TuxCare onboarded 4.1.72.Final (commit fc0a8abd) with the fix already present. Both defense me...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.72.Final. The vulnerability (silent sanitization of control characters in HTTP header names leading to request smuggling) was fixed in upstream commit 07aa6b5938a8 on Dec 9, 2021. Netty 4.1.72.Final was released on Dec 10, 2021 and already contained this fix. TuxCare onboarded 4.1.72.Final (commit fc0a8abd) with the fix already present. Both defense me..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Version 4.1.72.Final is NOT AFFECTED by CVE-2026-42580. The target uses Java's Integer.parseInt(hex, 16) for chunk size parsing, which properly throws NumberFormatException for values exceeding Integer.MAX_VALUE (2,147,483,647). The vulnerable manual parsing code (with int overflow and insufficient validation) was introduced in upstream Netty in January 2023 via commit 0daaec3ac2 (\"Speed-up HTT...",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.72.Final is NOT AFFECTED by CVE-2026-42580. The target uses Java's Integer.parseInt(hex, 16) for chunk size parsing, which properly throws NumberFormatException for values exceeding Integer.MAX_VALUE (2,147,483,647). The vulnerable manual parsing code (with int overflow and insufficient validation) was introduced in upstream Netty in January 2023 via commit 0daaec3ac2 (\"Speed-up HTT..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:44.947302+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:44.947302+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-codec-http."
    }
  ]
}