{
  "@id": "urn:uuid:4d7080b4-026d-4325-988f-2f25cd1c1b6f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:39:17.792853+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 is not present in Netty 4.1.96.Final. The vulnerability affects versions before 4.1.44, allowing HTTP headers without colons to be accepted and processed. The upstream fix (commit a7c18d44b4) that validates colon presence in header lines was already included in the upstream 4.1.96.Final release that TuxCare onboarded. The fix is present at HttpObjectDecoder.java:959-962, where it throws IllegalArgumentException when no colon is found in a header line.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is not present in Netty 4.1.96.Final. The vulnerability affects versions before 4.1.44, allowing HTTP headers without colons to be accepted and processed. The upstream fix (commit a7c18d44b4) that validates colon presence in header lines was already included in the upstream 4.1.96.Final release that TuxCare onboarded. The fix is present at HttpObjectDecoder.java:959-962, where it throws IllegalArgumentException when no colon is found in a header line."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is NOT present in the target. The vulnerability (insecure temporary file creation with world-readable permissions) was fixed by upstream Netty in commit c735357bf2 (author: norman_maurer@apple.com) which shipped in Netty 4.1.59.Final. The target version 4.1.96.Final already contains this upstream fix - the vulnerable File.createTempFile() API has been replaced with the secure Pla...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is NOT present in the target. The vulnerability (insecure temporary file creation with world-readable permissions) was fixed by upstream Netty in commit c735357bf2 (author: norman_maurer@apple.com) which shipped in Netty 4.1.59.Final. The target version 4.1.96.Final already contains this upstream fix - the vulnerable File.createTempFile() API has been replaced with the secure Pla..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 fix was included in upstream Netty 4.1.72.Final (released 2021-12-13). Target version 4.1.96.Final (released 2023-07-27) already contains the fix from the upstream vendor. The target's HttpObjectDecoder.findNonWhitespace() method always validates that only OWS (space 0x20 or tab 0x09) is allowed as whitespace in header names, matching the patched behavior. The vulnerable pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 fix was included in upstream Netty 4.1.72.Final (released 2021-12-13). Target version 4.1.96.Final (released 2023-07-27) already contains the fix from the upstream vendor. The target's HttpObjectDecoder.findNonWhitespace() method always validates that only OWS (space 0x20 or tab 0x09) is allowed as whitespace in header names, matching the patched behavior. The vulnerable pattern ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.96.Final) is NOT affected by CVE-2022-24823. This vulnerability involved insecure temporary file creation where files created via PlatformDependent.createTempFile() could be world-readable when the directory parameter was null, causing local information disclosure. The fix (commit 185f8b2756a36aaa4f973f1a2a025e7d981823f1) was authored by upstream Netty maintaine...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.96.Final) is NOT affected by CVE-2022-24823. This vulnerability involved insecure temporary file creation where files created via PlatformDependent.createTempFile() could be world-readable when the directory parameter was null, causing local information disclosure. The fix (commit 185f8b2756a36aaa4f973f1a2a025e7d981823f1) was authored by upstream Netty maintaine..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T08:59:00.065653+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via iterator validation bypass) is NOT present in target version 4.1.96.Final. The vulnerability affected DefaultHeaders.setObject methods when called with iterators/arrays - these methods converted values but did not call validateValue, allowing CRLF injection. The upstream fix (commit fe18adff1c by christianvest_hansen@apple.com) added validateValue cal...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via iterator validation bypass) is NOT present in target version 4.1.96.Final. The vulnerability affected DefaultHeaders.setObject methods when called with iterators/arrays - these methods converted values but did not call validateValue, allowing CRLF injection. The upstream fix (commit fe18adff1c by christianvest_hansen@apple.com) added validateValue cal..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:33:00.544181+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:33:00.544181+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:11:55.615529+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.96.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.96.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:11:55.615529+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.96.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.96.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:11:55.615529+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.96.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.96.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:33:00.544181+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:33:00.544181+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:33:00.544181+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.96.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:31:48.777580+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.96.Final-tuxcare.1 of io.netty:netty-codec-http."
    }
  ]
}