{ "@id": "urn:uuid:83613056-53e3-4d09-b3e0-d70574112412", "role": "Document Creator", "author": "https://tuxcare.com", "version": 26, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-02T17:29:00.121332+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T17:24:00.135693+00:00", "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 (HTTP Request Smuggling via Content-Length mismatch) is NOT present in target Netty 4.1.135.Final. The vulnerability was fixed upstream in Netty 4.1.60.Final (March 2021) by commit 89c241e3 authored by Norman Maurer (norman_maurer@apple.com). The fix adds content-length validation in DefaultHttp2ConnectionDecoder that verifies the declared Content-Length header matches the actual...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21295" }, "impact_statement": "not_affected \u2014 CVE-2021-21295 (HTTP Request Smuggling via Content-Length mismatch) is NOT present in target Netty 4.1.135.Final. The vulnerability was fixed upstream in Netty 4.1.60.Final (March 2021) by commit 89c241e3 authored by Norman Maurer (norman_maurer@apple.com). The fix adds content-length validation in DefaultHttp2ConnectionDecoder that verifies the declared Content-Length header matches the actual..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T17:29:00.121332+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in the target repository. The vulnerability involved missing content-length header validation when HTTP/2 headers arrive with endStream=true in a single frame, which could lead to request smuggling when proxied to HTTP/1.1 backends. The fix (commit b0fa4d5aab by Norman Maurer) was already included in the upstream Netty 4.1.61.Final release. Since the target is at v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in the target repository. The vulnerability involved missing content-length header validation when HTTP/2 headers arrive with endStream=true in a single frame, which could lead to request smuggling when proxied to HTTP/1.1 backends. The fix (commit b0fa4d5aab by Norman Maurer) was already included in the upstream Netty 4.1.61.Final release. Since the target is at v..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55163 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2025-55163 (MadeYouReset vulnerability). The Http2MaxRstFrameLimitEncoder class is present and enabled by default for HTTP/2 servers, rate-limiting server-sent RST_STREAM frames to prevent resource exhaustion attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55163" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2025-55163 (MadeYouReset vulnerability). The Http2MaxRstFrameLimitEncoder class is present and enabled by default for HTTP/2 servers, rate-limiting server-sent RST_STREAM frames to prevent resource exhaustion attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33871 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2. already_fixed \u2014 Target version 4.1.135.Final already contains the complete CVE-2026-33871 fix. The vendor patch (commit 9f47a7b6846e6c7cb0481789be51788944042b85) limiting CONTINUATION frames was included in the upstream Netty 4.1.135.Final release and is present in the TuxCare repository at the analyzed SHA 445f793ae39ed92ac7ca250dce68cc80b0596785.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33871" }, "impact_statement": "already_fixed \u2014 Target version 4.1.135.Final already contains the complete CVE-2026-33871 fix. The vendor patch (commit 9f47a7b6846e6c7cb0481789be51788944042b85) limiting CONTINUATION frames was included in the upstream Netty 4.1.135.Final release and is present in the TuxCare repository at the analyzed SHA 445f793ae39ed92ac7ca250dce68cc80b0596785." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains all fixes from the three upstream security patches (fe702a97, 21b8493b, bf78040e) that address CVE-2026-42587. BrotliDecoder and ZstdDecoder both receive maxAllocation parameters, and BrotliDecoder enforces a 64 KiB per-buffer limit to prevent unbounded decompression.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains all fixes from the three upstream security patches (fe702a97, 21b8493b, bf78040e) that address CVE-2026-42587. BrotliDecoder and ZstdDecoder both receive maxAllocation parameters, and BrotliDecoder enforces a 64 KiB per-buffer limit to prevent unbounded decompression." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47244 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2. already_fixed \u2014 CVE-2026-47244 has been mitigated in target version 4.1.135.Final. Both required fix patches are present: (1) Http2Settings.defaultSettings() now advertises maxConcurrentStreams=100 by default, and (2) AbstractHttp2ConnectionHandlerBuilder immediately enforces this limit on the remote endpoint during handler initialization. The vulnerability described in the CVE - unlimited concurrent stream cr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47244" }, "impact_statement": "already_fixed \u2014 CVE-2026-47244 has been mitigated in target version 4.1.135.Final. Both required fix patches are present: (1) Http2Settings.defaultSettings() now advertises maxConcurrentStreams=100 by default, and (2) AbstractHttp2ConnectionHandlerBuilder immediately enforces this limit on the remote endpoint during handler initialization. The vulnerability described in the CVE - unlimited concurrent stream cr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the fix for CVE-2026-48043. The vulnerability involved a ByteBuf memory leak in DelegatingDecompressorFrameListener when flow controller exceptions occurred. The fix moves buf.release() into a finally block to ensure cleanup even when exceptions are thrown. This fix is present in the target at lines 381-383 of DelegatingDecompressorFr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48043" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the fix for CVE-2026-48043. The vulnerability involved a ByteBuf memory leak in DelegatingDecompressorFrameListener when flow controller exceptions occurred. The fix moves buf.release() into a finally block to ensure cleanup even when exceptions are thrown. This fix is present in the target at lines 381-383 of DelegatingDecompressorFr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50560 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the fix for CVE-2026-50560. The vulnerable code pattern has been patched: servers now ignore the MAX_HEADER_LIST_SIZE setting sent by clients, preventing the DoS attack where malicious clients could set arbitrarily small header size limits to prevent the server from sending valid responses.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50560" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the fix for CVE-2026-50560. The vulnerable code pattern has been patched: servers now ignore the MAX_HEADER_LIST_SIZE setting sent by clients, preventing the DoS attack where malicious clients could set arbitrarily small header size limits to prevent the server from sending valid responses." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-56819" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59900 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-59900" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http2." } ] }