{ "@id": "urn:uuid:1cf1dc6e-a112-4753-b1e5-ed89aeeabc3e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 25, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-02T17:30:18.916796+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T17:24:00.135693+00:00", "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 request smuggling vulnerability is NOT present in target Netty 4.1.130.Final. The upstream fix (commit 89c241e3b1 from March 2021) was already included in the upstream 4.1.130.Final release before TuxCare onboarding. The fix validates Content-Length headers (rejects negative/empty/malformed values) and enforces that the sum of HTTP/2 DATA frames exactly matches the declared Conte...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21295" }, "impact_statement": "not_affected \u2014 CVE-2021-21295 request smuggling vulnerability is NOT present in target Netty 4.1.130.Final. The upstream fix (commit 89c241e3b1 from March 2021) was already included in the upstream 4.1.130.Final release before TuxCare onboarding. The fix validates Content-Length headers (rejects negative/empty/malformed values) and enforces that the sum of HTTP/2 DATA frames exactly matches the declared Conte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T17:30:18.916796+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 affects Netty versions prior to 4.1.61.Final. The target version (4.1.130.Final) already contains the upstream fix that validates content-length headers even when a single HTTP/2 HEADERS frame has endStream=true. The fix was introduced by upstream commit b0fa4d5aab4 (author: Norman Maurer) and was present in the upstream 4.1.130.Final release that TuxCare onboarded. The vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 CVE-2021-21409 affects Netty versions prior to 4.1.61.Final. The target version (4.1.130.Final) already contains the upstream fix that validates content-length headers even when a single HTTP/2 HEADERS frame has endStream=true. The fix was introduced by upstream commit b0fa4d5aab4 (author: Norman Maurer) and was present in the upstream 4.1.130.Final release that TuxCare onboarded. The vulnerabl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55163 does not affect version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2. already_fixed \u2014 The target Netty 4.1.130.Final repository already contains the complete MadeYouReset (CVE-2025-55163) mitigation. The Http2MaxRstFrameLimitEncoder defense class is present, integrated into the HTTP/2 connection handler builder, and enabled by default for servers with a threshold of 200 RST_STREAM frames per 30-second window. All protocol-error-triggered RST writes route through the protected en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55163" }, "impact_statement": "already_fixed \u2014 The target Netty 4.1.130.Final repository already contains the complete MadeYouReset (CVE-2025-55163) mitigation. The Http2MaxRstFrameLimitEncoder defense class is present, integrated into the HTTP/2 connection handler builder, and enabled by default for servers with a threshold of 200 RST_STREAM frames per 30-second window. All protocol-error-triggered RST writes route through the protected en..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-33871" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-42587" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48043 is fixed in version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-48043" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-50560" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.3.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.3.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.130.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.130.Final-tuxcare.1 of io.netty:netty-codec-http2." } ] }