{
  "@id": "urn:uuid:f0a17606-544c-404d-8900-6881e77cbaeb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T18:50:00.057997+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21295"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21409"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2. Netty 4.1.46.Final is not affected by CVE-2026-42587. The vulnerability describes a bypass where attackers can circumvent a configured maxAllocation limit by switching from Content-Encoding: gzip to Content-Encoding: br/zstd/snappy. This version predates the vulnerable feature entirely: (1) HttpContentDecompressor has no maxAllocation parameter, (2) Brotli/Zstd/Snappy encodings are not supported in HTTP decompressors, (3) requests with these encodings are passed through without decompression. The specific bypass attack path described in the CVE cannot exist because the target code neither accepts these content encodings nor exposes the maxAllocation API. The vulnerable code pattern was introduced in later commits (a155024263 and 51260aa57e) that are not ancestors of this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Netty 4.1.46.Final is not affected by CVE-2026-42587. The vulnerability describes a bypass where attackers can circumvent a configured maxAllocation limit by switching from Content-Encoding: gzip to Content-Encoding: br/zstd/snappy. This version predates the vulnerable feature entirely: (1) HttpContentDecompressor has no maxAllocation parameter, (2) Brotli/Zstd/Snappy encodings are not supported in HTTP decompressors, (3) requests with these encodings are passed through without decompression. The specific bypass attack path described in the CVE cannot exist because the target code neither accepts these content encodings nor exposes the maxAllocation API. The vulnerable code pattern was introduced in later commits (a155024263 and 51260aa57e) that are not ancestors of this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-codec-http2."
    }
  ]
}