{
  "@id": "urn:uuid:c3a50b61-0e97-4656-8c81-141e756e8519",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T05:43:01.502758+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in Netty 4.1.76.Final. The vulnerability allowed HTTP headers without colons to be accepted, enabling header smuggling/confusion. The upstream fix (commit a7c18d44b4, \"Detect missing colon when parsing http headers with no value\") was included in Netty 4.1.44.Final and is present in the target version 4.1.76.Final at HttpObjectDecoder.java:870-873. The fix rejects header lines lacking colons by throwing IllegalArgumentException when nameEnd==length. This fix shipped with the upstream release before TuxCare onboarding (commit 6912525f3d \"Onboard version 4.1.76.Final\"), making it an upstream fix, not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is NOT present in Netty 4.1.76.Final. The vulnerability allowed HTTP headers without colons to be accepted, enabling header smuggling/confusion. The upstream fix (commit a7c18d44b4, \"Detect missing colon when parsing http headers with no value\") was included in Netty 4.1.44.Final and is present in the target version 4.1.76.Final at HttpObjectDecoder.java:870-873. The fix rejects header lines lacking colons by throwing IllegalArgumentException when nameEnd==length. This fix shipped with the upstream release before TuxCare onboarding (commit 6912525f3d \"Onboard version 4.1.76.Final\"), making it an upstream fix, not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 addresses insecure temporary file creation in Netty's multipart decoders. The vulnerability allowed local users to read sensitive uploaded file data due to world-readable permissions (-rw-r--r--) on temporary files created by File.createTempFile(). The target version 4.1.76.Final is NOT affected because the upstream vendor (Norman Maurer) fixed this vulnerability in commit c73535...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 addresses insecure temporary file creation in Netty's multipart decoders. The vulnerability allowed local users to read sensitive uploaded file data due to world-readable permissions (-rw-r--r--) on temporary files created by File.createTempFile(). The target version 4.1.76.Final is NOT affected because the upstream vendor (Norman Maurer) fixed this vulnerability in commit c73535..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 fix is already present in Netty 4.1.76.Final. The vulnerability involved Netty silently stripping control characters from HTTP header names instead of rejecting them, enabling HTTP request smuggling when used as a proxy. The upstream fix (commit 07aa6b5938a8, Dec 2021) added validation to reject control chars 0x1c-0x1f in header names and enforced strict OWS-only whitespace valid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 fix is already present in Netty 4.1.76.Final. The vulnerability involved Netty silently stripping control characters from HTTP header names instead of rejecting them, enabling HTTP request smuggling when used as a proxy. The upstream fix (commit 07aa6b5938a8, Dec 2021) added validation to reject control chars 0x1c-0x1f in header names and enforced strict OWS-only whitespace valid..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 is fixed in version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default validation checks each iterable header value and blocks response-splitting payloads before insertion. The public setter delegates to setObject at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:188, which converts every non-null value at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:488. The validator rejects an injected header after CR/LF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:503.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default validation checks each iterable header value and blocks response-splitting payloads before insertion. The public setter delegates to setObject at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:188, which converts every non-null value at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:488. The validator rejects an injected header after CR/LF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:503."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 Version 4.1.76.Final is NOT affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow validation and throws NumberFormatException when values exceed Integer.MAX_VALUE. The vulnerable code pattern (manual int accumulation with insufficient overflow checking: result *= 16; result += digit; if (result < 0)) does not exist in this ve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.76.Final is NOT affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow validation and throws NumberFormatException when values exceed Integer.MAX_VALUE. The vulnerable code pattern (manual int accumulation with insufficient overflow checking: result *= 16; result += digit; if (result < 0)) does not exist in this ve..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-codec-http."
    }
  ]
}