{
  "@id": "urn:uuid:99e4e8df-8869-4d30-b593-6e184bcef94b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T14:09:00.038715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:38:47.406690+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http. Target Netty 4.1.82.Final already contains the fix for CVE-2019-20444 from the upstream release. The vulnerability (HTTP headers lacking colon separators) was fixed in Netty 4.1.44 (December 2019) by Norman Maurer from Apple. The target version was released in May 2022, 2.5 years after the fix, and inherited the protection code from upstream. The validation logic at HttpObjectDecoder.java:945-948 rejects header lines without colons by throwing IllegalArgumentException.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "Target Netty 4.1.82.Final already contains the fix for CVE-2019-20444 from the upstream release. The vulnerability (HTTP headers lacking colon separators) was fixed in Netty 4.1.44 (December 2019) by Norman Maurer from Apple. The target version was released in May 2022, 2.5 years after the fix, and inherited the protection code from upstream. The validation logic at HttpObjectDecoder.java:945-948 rejects header lines without colons by throwing IllegalArgumentException."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is NOT present in Netty 4.1.82.Final. The vulnerability (insecure temporary file creation with world-readable permissions) was fixed by upstream commit c735357bf29d07856ad171c6611a2e1a0e0000ec, which replaced File.createTempFile() with PlatformDependent.createTempFile() that uses Files.createTempFile() (Java 7+) or manually adjusts permissions (Java 6). This fix was already prese...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is NOT present in Netty 4.1.82.Final. The vulnerability (insecure temporary file creation with world-readable permissions) was fixed by upstream commit c735357bf29d07856ad171c6611a2e1a0e0000ec, which replaced File.createTempFile() with PlatformDependent.createTempFile() that uses Files.createTempFile() (Java 7+) or manually adjusts permissions (Java 6). This fix was already prese..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Target Netty 4.1.82.Final-tuxcare.8 is not affected by CVE-2021-43797. The vulnerability fix was already present in the upstream Netty 4.1.82.Final release before TuxCare onboarded it. The fix validates control characters (0x1c-0x1f) in header names and enforces OWS-only whitespace validation, preventing HTTP request smuggling via invalid header names.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 Target Netty 4.1.82.Final-tuxcare.8 is not affected by CVE-2021-43797. The vulnerability fix was already present in the upstream Netty 4.1.82.Final release before TuxCare onboarded it. The fix validates control characters (0x1c-0x1f) in header names and enforces OWS-only whitespace validation, preventing HTTP request smuggling via invalid header names."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 (insecure temporary file creation in Netty multipart decoders on Java 6) is NOT present in target version 4.1.82.Final. The upstream fix from commit 185f8b2756a (introduced in Netty 4.1.77.Final) is already included in the target. The vulnerable code pattern - returning directly from File.createTempFile() without setting owner-only permissions when directory==null - has been repl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 (insecure temporary file creation in Netty multipart decoders on Java 6) is NOT present in target version 4.1.82.Final. The upstream fix from commit 185f8b2756a (introduced in Netty 4.1.77.Final) is already included in the target. The vulnerable code pattern - returning directly from File.createTempFile() without setting owner-only permissions when directory==null - has been repl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.82.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.82.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T17:52:24.426616+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.82.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.82.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.82.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.82.Final-tuxcare.1 of io.netty:netty-codec-http."
    }
  ]
}