{ "@id": "urn:uuid:ae7a6a6d-7f10-401a-8737-ad31149b57c7", "role": "Document Creator", "author": "https://tuxcare.com", "version": 26, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T16:32:00.109512+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-05T09:41:00.107120+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in Netty 4.2.2.Final-tuxcare.1. The vulnerability allowed HTTP headers without colons to be accepted, potentially enabling header injection attacks. The upstream fix (commit a7c18d44b4, December 2019) added validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when a header line lacks a colon separator. This fix was already present in the upstream Netty 4.2.2.Final release that TuxCare onboarded on September 14, 2026, predating any TuxCare modifications. The defense is confirmed at HttpObjectDecoder.java:1121-1123.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 is NOT present in Netty 4.2.2.Final-tuxcare.1. The vulnerability allowed HTTP headers without colons to be accepted, potentially enabling header injection attacks. The upstream fix (commit a7c18d44b4, December 2019) added validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when a header line lacks a colon separator. This fix was already present in the upstream Netty 4.2.2.Final release that TuxCare onboarded on September 14, 2026, predating any TuxCare modifications. The defense is confirmed at HttpObjectDecoder.java:1121-1123." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 fix was already present in upstream Netty 4.2.2.Final release (tagged 2025-06-05) before TuxCare onboarded it. The vulnerable File.createTempFile() API has been replaced with PlatformDependent.createTempFile() which uses Files.createTempFile() to create temporary files with secure owner-only permissions, preventing local information disclosure. Fix authored by Norman Maurer (upst...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 CVE-2021-21290 fix was already present in upstream Netty 4.2.2.Final release (tagged 2025-06-05) before TuxCare onboarded it. The vulnerable File.createTempFile() API has been replaced with PlatformDependent.createTempFile() which uses Files.createTempFile() to create temporary files with secure owner-only permissions, preventing local information disclosure. Fix authored by Norman Maurer (upst..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.2.2.Final is NOT AFFECTED by CVE-2021-43797. The vulnerability involves silently stripping control characters from HTTP header names, enabling request smuggling when Netty acts as a proxy. The target version uses a different architecture (Netty 5.x-style validation) where header names are validated via HttpHeaderValidationUtil.validateToken() which REJECTS (not strips) control ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 Target version 4.2.2.Final is NOT AFFECTED by CVE-2021-43797. The vulnerability involves silently stripping control characters from HTTP header names, enabling request smuggling when Netty acts as a proxy. The target version uses a different architecture (Netty 5.x-style validation) where header names are validated via HttpHeaderValidationUtil.validateToken() which REJECTS (not strips) control ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in target version 4.2.2.Final. The vulnerable code pattern (using File.createTempFile() without permission adjustment when directory==null, creating world-readable files) does not exist. The target uses Files.createTempFile() from Java 7+ NIO API, which creates files with owner-only permissions by default. The upstream fix (commit 185f8b2756) was already included i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in target version 4.2.2.Final. The vulnerable code pattern (using File.createTempFile() without permission adjustment when directory==null, creating world-readable files) does not exist. The target uses Files.createTempFile() from Java 7+ NIO API, which creates files with owner-only permissions by default. The upstream fix (commit 185f8b2756) was already included i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T09:00:03.330807+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is not present in this version. The upstream fix (commit fe18adff1c2b from Dec 2022) was already included in Netty 4.2.2.Final when it was released (June 2025) and subsequently onboarded by TuxCare (Sep 2026). The vulnerable code pattern\u2014missing validation in setObject(Iterable) and setObject(Object...) methods\u2014has been replaced with proper CRLF validation that rejects malicious ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 is not present in this version. The upstream fix (commit fe18adff1c2b from Dec 2022) was already included in Netty 4.2.2.Final when it was released (June 2025) and subsequently onboarded by TuxCare (Sep 2026). The vulnerable code pattern\u2014missing validation in setObject(Iterable) and setObject(Object...) methods\u2014has been replaced with proper CRLF validation that rejects malicious ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T14:03:57.190528+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 describes a memory exhaustion vulnerability in Netty's HttpPostRequestDecoder that allows unbounded accumulation of form fields and buffered bytes. The upstream fix (commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c by Norman Maurer, March 21, 2024) added two limits: DEFAULT_MAX_FIELDS=128 and DEFAULT_MAX_BUFFERED_BYTES=1024, with corresponding checks that throw exceptions when lim...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 CVE-2024-29025 describes a memory exhaustion vulnerability in Netty's HttpPostRequestDecoder that allows unbounded accumulation of form fields and buffered bytes. The upstream fix (commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c by Norman Maurer, March 21, 2024) added two limits: DEFAULT_MAX_FIELDS=128 and DEFAULT_MAX_BUFFERED_BYTES=1024, with corresponding checks that throw exceptions when lim..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2026-42580 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42580" }, "action_statement": "Vulnerability CVE-2026-42580 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-42587 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" }, "action_statement": "Vulnerability CVE-2026-42587 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-11-12T16:32:00.109512+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.2.2.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T08:23:08.977637+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.2.2.Final-tuxcare.1 of io.netty:netty-codec-http." } ] }