{
  "@id": "urn:uuid:8d3cb0e5-2e91-4cbe-939a-aeba6f7454dc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T09:39:17.792853+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before version 4.1.44. The target repository is at version 4.1.93.Final, which already contains the upstream fix. The vulnerability (missing colon validation in HTTP header parsing) is not present because the fix was shipped in the upstream release before TuxCare onboarded this version. The fix commit (a7c18d44b4) authored by Norman Maurer adds validation to reject HTTP header lines that lack a colon separator, preventing header injection and request smuggling attacks through invalid header folding.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty before version 4.1.44. The target repository is at version 4.1.93.Final, which already contains the upstream fix. The vulnerability (missing colon validation in HTTP header parsing) is not present because the fix was shipped in the upstream release before TuxCare onboarded this version. The fix commit (a7c18d44b4) authored by Norman Maurer adds validation to reject HTTP header lines that lack a colon separator, preventing header injection and request smuggling attacks through invalid header folding."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is not present in target netty 4.1.93.Final-tuxcare.4. The vulnerability involved insecure temporary file creation with world-readable permissions in AbstractDiskHttpData. The upstream fix (commit c735357bf2 by Norman Maurer, Feb 2021) replaced File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.createTempFile() on Java 7+ to create files with owner-on...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is not present in target netty 4.1.93.Final-tuxcare.4. The vulnerability involved insecure temporary file creation with world-readable permissions in AbstractDiskHttpData. The upstream fix (commit c735357bf2 by Norman Maurer, Feb 2021) replaced File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.createTempFile() on Java 7+ to create files with owner-on..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 fix is already present in target version 4.1.93.Final. The vulnerability involved HTTP header names with control characters or non-OWS whitespace being silently stripped instead of rejected, enabling HTTP request smuggling. The fix was introduced in upstream commit 07aa6b5938 by Norman Maurer and shipped in the upstream 4.1.93.Final release before TuxCare onboarded it. The target...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 fix is already present in target version 4.1.93.Final. The vulnerability involved HTTP header names with control characters or non-OWS whitespace being silently stripped instead of rejected, enabling HTTP request smuggling. The fix was introduced in upstream commit 07aa6b5938 by Norman Maurer and shipped in the upstream 4.1.93.Final release before TuxCare onboarded it. The target..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 describes an insecure temporary file creation vulnerability in netty for Java 6 when directory parameter is null. The target repository at 4.1.93.Final contains the complete upstream fix (commit 185f8b2756) which was released in netty 4.1.77.Final (May 2022), 16 versions before 4.1.93.Final (June 2023). The vulnerable code pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 describes an insecure temporary file creation vulnerability in netty for Java 6 when directory parameter is null. The target repository at 4.1.93.Final contains the complete upstream fix (commit 185f8b2756) which was released in netty 4.1.77.Final (May 2022), 16 versions before 4.1.93.Final (June 2023). The vulnerable code pattern is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T08:53:45.706139+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via missing header validation in iterator/array setObject methods) is NOT present in the target. The upstream fix commit fe18adff1c was already included in Netty 4.1.93.Final when TuxCare onboarded it. The vulnerable code pattern (missing validateValue calls in DefaultHeaders.setObject for iterator/array parameters) has been patched. Validation is enabled...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via missing header validation in iterator/array setObject methods) is NOT present in the target. The upstream fix commit fe18adff1c was already included in Netty 4.1.93.Final when TuxCare onboarded it. The vulnerable code pattern (missing validateValue calls in DefaultHeaders.setObject for iterator/array parameters) has been patched. Validation is enabled..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.93.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.93.Final-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.93.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.93.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.93.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.93.Final-tuxcare.3 of io.netty:netty-codec-http."
    }
  ]
}