{
  "@id": "urn:uuid:a12f8c6e-6217-492c-a122-3fbf20e17fc7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:30:18.916796+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 fix is already present in netty 4.1.117.Final. The vulnerability concerned HTTP/2 to HTTP/1.1 request smuggling due to missing Content-Length validation. The fix (commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 by Norman Maurer) was included in upstream netty 4.1.60.Final and is present in the 4.1.117.Final release that TuxCare onboarded. The target contains all fix components: H...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 fix is already present in netty 4.1.117.Final. The vulnerability concerned HTTP/2 to HTTP/1.1 request smuggling due to missing Content-Length validation. The fix (commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 by Norman Maurer) was included in upstream netty 4.1.60.Final and is present in the 4.1.117.Final release that TuxCare onboarded. The target contains all fix components: H..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:30:18.916796+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409: The target repository (Netty 4.1.117.Final) is not affected because the vulnerability was fixed in upstream release 4.1.61.Final and this fix is present in the target version. The fix adds proper content-length validation for single HTTP/2 HEADERS frames with endStream=true by computing the isTrailers state before validation, preventing request smuggling attacks when proxying to...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409: The target repository (Netty 4.1.117.Final) is not affected because the vulnerability was fixed in upstream release 4.1.61.Final and this fix is present in the target version. The fix adds proper content-length validation for single HTTP/2 HEADERS frames with endStream=true by computing the isTrailers state before validation, preventing request smuggling attacks when proxying to..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-codec-http2."
    }
  ]
}