{
  "@id": "urn:uuid:3d5c602c-f240-46f0-9008-d277929a9a2c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T10:33:15.957794+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.29.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.29.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:43:07.950754+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:43:07.950754+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:43:07.950754+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:43:07.950754+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2. Netty 4.1.29.Final is not affected by CVE-2026-42587. This version predates the vulnerable feature: HttpContentDecompressor has no maxAllocation parameter and does not support brotli, zstd, or snappy encodings. The CVE describes a bypass of maxAllocation protection for these encodings in later versions that added this decompression bomb protection feature. Since the feature does not exist in 4.1.29.Final, the vulnerability pattern cannot manifest.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Netty 4.1.29.Final is not affected by CVE-2026-42587. This version predates the vulnerable feature: HttpContentDecompressor has no maxAllocation parameter and does not support brotli, zstd, or snappy encodings. The CVE describes a bypass of maxAllocation protection for these encodings in later versions that added this decompression bomb protection feature. Since the feature does not exist in 4.1.29.Final, the vulnerability pattern cannot manifest."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:43:07.950754+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:43:07.950754+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:39.156684+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.29.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      },
      "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.29.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:49:39.156684+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.29.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.29.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:43:07.950754+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.29.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T18:43:07.950754+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.29.Final-tuxcare.2 of io.netty:netty-codec-http2."
    }
  ]
}