{
  "@id": "urn:uuid:9f61d950-ffe3-42c5-b74f-5c0a6264be24",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T08:38:53.189992+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in target Netty 4.1.81.Final. The upstream fix (commit a7c18d44b4 by Norman Maurer, Dec 11 2019) adds validation in HttpObjectDecoder.splitHeader() that rejects HTTP header lines lacking a colon by throwing IllegalArgumentException(\"No colon found\"). This fix was already included in the upstream 4.1.81.Final release when TuxCare onboarded it (first TuxCare commit e6254f3fba). The defense at lines 945-948 blocks the attack vector: colon-less header lines cannot reach the goal of being accepted and causing parsing confusion.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is NOT present in target Netty 4.1.81.Final. The upstream fix (commit a7c18d44b4 by Norman Maurer, Dec 11 2019) adds validation in HttpObjectDecoder.splitHeader() that rejects HTTP header lines lacking a colon by throwing IllegalArgumentException(\"No colon found\"). This fix was already included in the upstream 4.1.81.Final release when TuxCare onboarded it (first TuxCare commit e6254f3fba). The defense at lines 945-948 blocks the attack vector: colon-less header lines cannot reach the goal of being accepted and causing parsing confusion."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.81.Final is NOT affected by CVE-2021-21290. The vulnerability (insecure temporary file creation with world-readable permissions in AbstractDiskHttpData) was fixed in upstream version 4.1.59.Final by commit c735357bf2 (Norman Maurer). This fix replaced File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.createTempFile() to set secure POSIX permissio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.81.Final is NOT affected by CVE-2021-21290. The vulnerability (insecure temporary file creation with world-readable permissions in AbstractDiskHttpData) was fixed in upstream version 4.1.59.Final by commit c735357bf2 (Norman Maurer). This fix replaced File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.createTempFile() to set secure POSIX permissio..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.81.Final. The vulnerability concerns control characters in HTTP header names that should be rejected but were previously skipped/sanitized, potentially enabling HTTP request smuggling when Netty acts as a proxy. The upstream fix (commit 07aa6b5938a8b6ed7a6586e066400e2643897323 by Norman Maurer) was already included in the upstream 4.1.81.Final release ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.81.Final. The vulnerability concerns control characters in HTTP header names that should be rejected but were previously skipped/sanitized, potentially enabling HTTP request smuggling when Netty acts as a proxy. The upstream fix (commit 07aa6b5938a8b6ed7a6586e066400e2643897323 by Norman Maurer) was already included in the upstream 4.1.81.Final release ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 affects Netty versions prior to 4.1.77.Final, where temporary files created during multipart upload processing on Java 6 were world-readable when created in the system temp directory (directory==null case). The target repository is version 4.1.81.Final, which already contains the upstream fix (commit 185f8b2756) that was first released in Netty 4.1.77.Final. The vulnerable code p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 affects Netty versions prior to 4.1.77.Final, where temporary files created during multipart upload processing on Java 6 were world-readable when created in the system temp directory (directory==null case). The target repository is version 4.1.81.Final, which already contains the upstream fix (commit 185f8b2756) that was first released in Netty 4.1.77.Final. The vulnerable code p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http. Version 4.1.81.Final is not affected by this CVE. This version doesn't have the vulnerable code that this CVE is affecting.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Version 4.1.81.Final is not affected by this CVE. This version doesn't have the vulnerable code that this CVE is affecting."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http. not_affected \u2014 Version 4.1.81.Final is not affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which throws NumberFormatException on overflow values. The vulnerable manual accumulation code (byte[] parameter with result *= 16; result += digit) that exists in newer Netty versions (4.1.94+) is architecturally absent from 4.1.81.Final. The CVE PoC value 0x100000004 (4,...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.81.Final is not affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which throws NumberFormatException on overflow values. The vulnerable manual accumulation code (byte[] parameter with result *= 16; result += digit) that exists in newer Netty versions (4.1.94+) is architecturally absent from 4.1.81.Final. The CVE PoC value 0x100000004 (4,..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.81.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-12T08:38:53.189992+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.81.Final-tuxcare.5 of io.netty:netty-codec-http."
    }
  ]
}