{
  "@id": "urn:uuid:bbfab047-bc85-4461-82d2-d2c7283c0e49",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T09:43:00.043308+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T09:39:17.792853+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 is not present in target version 4.1.99.Final. The vulnerability affects Netty before 4.1.44, allowing HTTP headers without colons to be processed. The fix (commit a7c18d44b4 from 2019-12-11 by Norman Maurer) was already included in the upstream 4.1.99.Final release that TuxCare onboarded. The defense code at HttpObjectDecoder.java:959-962 checks if nameEnd==end and throws IllegalArgumentException(\"No colon found\"), preventing malformed headers from being accepted.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is not present in target version 4.1.99.Final. The vulnerability affects Netty before 4.1.44, allowing HTTP headers without colons to be processed. The fix (commit a7c18d44b4 from 2019-12-11 by Norman Maurer) was already included in the upstream 4.1.99.Final release that TuxCare onboarded. The defense code at HttpObjectDecoder.java:959-962 checks if nameEnd==end and throws IllegalArgumentException(\"No colon found\"), preventing malformed headers from being accepted."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.99.Final) is NOT AFFECTED by CVE-2021-21290. The vulnerability concerns insecure temporary file creation with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData when using File.createTempFile(). The upstream fix (commit c735357bf2 by norman_maurer@apple.com) replaced File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.cre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.99.Final) is NOT AFFECTED by CVE-2021-21290. The vulnerability concerns insecure temporary file creation with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData when using File.createTempFile(). The upstream fix (commit c735357bf2 by norman_maurer@apple.com) replaced File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.cre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 fix is already present in target version 4.1.99.Final. The vulnerability (improper handling of control characters in HTTP header names leading to request smuggling) was fixed in upstream commit 07aa6b5938 by Norman Maurer on 2021-12-09, which predates the TuxCare onboarding of 4.1.99.Final (2026-09-19). The target contains both required defenses: (1) HttpObjectDecoder.findNonWhit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 fix is already present in target version 4.1.99.Final. The vulnerability (improper handling of control characters in HTTP header names leading to request smuggling) was fixed in upstream commit 07aa6b5938 by Norman Maurer on 2021-12-09, which predates the TuxCare onboarding of 4.1.99.Final (2026-09-19). The target contains both required defenses: (1) HttpObjectDecoder.findNonWhit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 The target version 4.1.99.Final is NOT AFFECTED by CVE-2022-24823. The vulnerability involves insecure temporary file creation with world-readable permissions when directory parameter is null on Java 6. The fix for this CVE was released in upstream Netty 4.1.77.Final, and since the target is 4.1.99.Final (a later version), the fix was already present when TuxCare onboarded this version. The vul...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 The target version 4.1.99.Final is NOT AFFECTED by CVE-2022-24823. The vulnerability involves insecure temporary file creation with world-readable permissions when directory parameter is null on Java 6. The fix for this CVE was released in upstream Netty 4.1.77.Final, and since the target is 4.1.99.Final (a later version), the fix was already present when TuxCare onboarded this version. The vul..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 describes missing header value validation when calling DefaultHttpHeaders.set() with an iterator of values, allowing HTTP Response Splitting via CRLF injection. The target repository (Netty 4.1.99.Final at SHA 6ab54187078e62d9c7c4e84b1d0fa5e1884017c1) is NOT AFFECTED because the upstream fix commit fe18adff1c was already present in the upstream 4.1.99.Final release when TuxCare o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 describes missing header value validation when calling DefaultHttpHeaders.set() with an iterator of values, allowing HTTP Response Splitting via CRLF injection. The target repository (Netty 4.1.99.Final at SHA 6ab54187078e62d9c7c4e84b1d0fa5e1884017c1) is NOT AFFECTED because the upstream fix commit fe18adff1c was already present in the upstream 4.1.99.Final release when TuxCare o..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:46:00.144389+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:50:07.034715+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.99.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.99.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:50:07.034715+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.99.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.99.Final-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.99.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:45:16.799559+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.99.Final-tuxcare.3 of io.netty:netty-codec-http."
    }
  ]
}