{
  "@id": "urn:uuid:2732d6fb-7d79-430e-b30e-01ff7d0c854e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T09:47:00.050250+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T09:39:17.792853+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http. CVE-2019-20444 is not present in Netty 4.1.92.Final. The vulnerability was fixed in upstream Netty 4.1.44 (December 2019) via commit a7c18d44b4 by Norman Maurer. Since version 4.1.92.Final was released in March 2023, it already contains the upstream fix. The fix adds validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when a header line lacks a colon separator (nameEnd == end), preventing malformed headers from being parsed as valid.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is not present in Netty 4.1.92.Final. The vulnerability was fixed in upstream Netty 4.1.44 (December 2019) via commit a7c18d44b4 by Norman Maurer. Since version 4.1.92.Final was released in March 2023, it already contains the upstream fix. The fix adds validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when a header line lacks a colon separator (nameEnd == end), preventing malformed headers from being parsed as valid."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is not present in Netty 4.1.92.Final. The upstream fix (commit c735357bf29d07856ad171c6611a2e1a0e0000ec by Norman Maurer, Feb 8, 2021) replaced insecure File.createTempFile() with PlatformDependent.createTempFile() that uses Files.createTempFile() for Java 7+, setting owner-only permissions. This fix was already in the upstream 4.1.92.Final release when TuxCare onboarded it (Sep ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is not present in Netty 4.1.92.Final. The upstream fix (commit c735357bf29d07856ad171c6611a2e1a0e0000ec by Norman Maurer, Feb 8, 2021) replaced insecure File.createTempFile() with PlatformDependent.createTempFile() that uses Files.createTempFile() for Java 7+, setting owner-only permissions. This fix was already in the upstream 4.1.92.Final release when TuxCare onboarded it (Sep ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.92.Final. The vulnerability concerned HTTP header names with control characters (0x1c, 0x1d, 0x1e, 0x1f, 0x0c) at the beginning being silently skipped instead of rejected, enabling HTTP request smuggling. The fix (commit 07aa6b5938a8 by Norman Maurer, Dec 2021) was already present in the upstream 4.1.92.Final release when TuxCare onboarded it in Sept 2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.92.Final. The vulnerability concerned HTTP header names with control characters (0x1c, 0x1d, 0x1e, 0x1f, 0x0c) at the beginning being silently skipped instead of rejected, enabling HTTP request smuggling. The fix (commit 07aa6b5938a8 by Norman Maurer, Dec 2021) was already present in the upstream 4.1.92.Final release when TuxCare onboarded it in Sept 2..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 affects Netty versions prior to 4.1.77.Final. The target is version 4.1.92.Final, which is newer than the fixed version. The vulnerability involved insecure temporary file permissions when directory==null on Java 6, where files created via File.createTempFile() were world-readable. The fix added explicit permission controls throwing IOException on failure. Analysis confirms the c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 affects Netty versions prior to 4.1.77.Final. The target is version 4.1.92.Final, which is newer than the fixed version. The vulnerability involved insecure temporary file permissions when directory==null on Java 6, where files created via File.createTempFile() were world-readable. The fix added explicit permission controls throwing IOException on failure. Analysis confirms the c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T08:53:45.706139+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is not present in target version 4.1.92.Final. The vulnerability (missing header value validation in DefaultHeaders.setObject methods accepting Iterable/varargs parameters) was fixed in upstream Netty 4.1.86.Final via commit fe18adff1c2b333acb135ab779a3b9ba3295a1c4. Since the target is version 4.1.92.Final, the fix was already present in the upstream release when TuxCare onboarde...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 is not present in target version 4.1.92.Final. The vulnerability (missing header value validation in DefaultHeaders.setObject methods accepting Iterable/varargs parameters) was fixed in upstream Netty 4.1.86.Final via commit fe18adff1c2b333acb135ab779a3b9ba3295a1c4. Since the target is version 4.1.92.Final, the fix was already present in the upstream release when TuxCare onboarde..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-01T13:33:46.866683+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.92.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.92.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-01T13:33:46.866683+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.92.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.92.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.92.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http, and is fixed in 4.1.92.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.92.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.92.Final-tuxcare.4 of io.netty:netty-codec-http."
    }
  ]
}