{
  "@id": "urn:uuid:8e41cca0-ccbc-4a49-8cfa-405e7ced0f7c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T11:38:55.157382+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 is NOT present in Netty 4.1.118.Final. The upstream fix (commit 89c241e3b1 by Norman Maurer) was already included in this release when TuxCare onboarded it. The fix adds Content-Length validation to DefaultHttp2ConnectionDecoder.verifyContentLength() and HttpUtil.normalizeAndGetContentLength(), preventing HTTP/2-to-HTTP/1.1 request smuggling by ensuring the sum of data frame size...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 is NOT present in Netty 4.1.118.Final. The upstream fix (commit 89c241e3b1 by Norman Maurer) was already included in this release when TuxCare onboarded it. The fix adds Content-Length validation to DefaultHttp2ConnectionDecoder.verifyContentLength() and HttpUtil.normalizeAndGetContentLength(), preventing HTTP/2-to-HTTP/1.1 request smuggling by ensuring the sum of data frame size..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409: Target Netty 4.1.118.Final is NOT AFFECTED. The vulnerability (content-length validation bypass when HTTP/2 headers with endStream=true are received) is not present. The fix was shipped in upstream Netty 4.1.61.Final and was already in the 4.1.118.Final release when TuxCare onboarded it. Commit b0fa4d5a by Norman Maurer (Apple/Netty maintainer) fixed the issue by capturing the t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409: Target Netty 4.1.118.Final is NOT AFFECTED. The vulnerability (content-length validation bypass when HTTP/2 headers with endStream=true are received) is not present. The fix was shipped in upstream Netty 4.1.61.Final and was already in the 4.1.118.Final release when TuxCare onboarded it. Commit b0fa4d5a by Norman Maurer (Apple/Netty maintainer) fixed the issue by capturing the t..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:55.157382+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 Version 4.1.118.Final is not affected by CVE-2026-48043. The vulnerable code pattern does not exist in this version due to a different architectural implementation. While the upstream fix (commit db6138b168, June 2026) addresses a resource leak in versions using an anonymous ChannelInboundHandlerAdapter pattern, version 4.1.118.Final (released February 2025) uses a for-loop based architecture w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.118.Final is not affected by CVE-2026-48043. The vulnerable code pattern does not exist in this version due to a different architectural implementation. While the upstream fix (commit db6138b168, June 2026) addresses a resource leak in versions using an anonymous ChannelInboundHandlerAdapter pattern, version 4.1.118.Final (released February 2025) uses a for-loop based architecture w..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.118.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:07.320769+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.118.Final-tuxcare.3 of io.netty:netty-codec-http2."
    }
  ]
}