{
  "@id": "urn:uuid:6fac77fe-38e1-494b-b589-6fbb59f3d82f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:27:00.166718+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-02T17:19:42.526419+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 (HTTP/2-to-HTTP/1.1 request smuggling via unvalidated Content-Length header) is NOT present in target Netty 4.1.115.Final-tuxcare.13. The upstream fix commit 89c241e3b1 by Norman Maurer (Apple/Netty) is present in HEAD and was shipped in the upstream release before TuxCare's maintenance began. The fix validates Content-Length headers and tracks DATA frame bytes to ensure they mat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 (HTTP/2-to-HTTP/1.1 request smuggling via unvalidated Content-Length header) is NOT present in target Netty 4.1.115.Final-tuxcare.13. The upstream fix commit 89c241e3b1 by Norman Maurer (Apple/Netty) is present in HEAD and was shipped in the upstream release before TuxCare's maintenance began. The fix validates Content-Length headers and tracks DATA frame bytes to ensure they mat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-02T17:27:00.166718+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in target version 4.1.115.Final. The vulnerability was fixed by upstream Netty commit b0fa4d5aab4 (authored by Norman Maurer) in version 4.1.61.Final. Since the target is 4.1.115.Final (released after 4.1.61.Final), the fix was already included in the upstream release that TuxCare onboarded. The fix adds isTrailers tracking to ensure content-length validation execu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in target version 4.1.115.Final. The vulnerability was fixed by upstream Netty commit b0fa4d5aab4 (authored by Norman Maurer) in version 4.1.61.Final. Since the target is 4.1.115.Final (released after 4.1.61.Final), the fix was already included in the upstream release that TuxCare onboarded. The fix adds isTrailers tracking to ensure content-length validation execu..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-23T22:48:24.591646+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.12.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.12."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-22T18:49:00.136725+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.10."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 is fixed in version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.115.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.115.Final-tuxcare.7 of io.netty:netty-codec-http2."
    }
  ]
}