{
  "@id": "urn:uuid:9a1a1413-cab8-47fb-836e-0b490afb85a3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21295"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21409"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2. Version 4.1.51.Final does not support brotli, zstd, or snappy Content-Encoding decompression. The vulnerability concerns missing maxAllocation enforcement when these encodings are processed, but this version predates the feature entirely. BrotliDecoder and ZstdDecoder do not exist in the codebase, and SnappyFrameDecoder exists only as a standalone codec without HTTP integration. When requests arrive with Content-Encoding: br/zstd/snappy, the decompressor returns null and no decompression occurs. The vulnerable code path (decompressing these encodings without size limits) cannot manifest because the decompression logic for these encodings was not added until later versions. Git history confirms CVE-2026-42587 was backported to versions 4.1.79+ but NOT to 4.1.51.Final.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Version 4.1.51.Final does not support brotli, zstd, or snappy Content-Encoding decompression. The vulnerability concerns missing maxAllocation enforcement when these encodings are processed, but this version predates the feature entirely. BrotliDecoder and ZstdDecoder do not exist in the codebase, and SnappyFrameDecoder exists only as a standalone codec without HTTP integration. When requests arrive with Content-Encoding: br/zstd/snappy, the decompressor returns null and no decompression occurs. The vulnerable code path (decompressing these encodings without size limits) cannot manifest because the decompression logic for these encodings was not added until later versions. Git history confirms CVE-2026-42587 was backported to versions 4.1.79+ but NOT to 4.1.51.Final."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      }
    }
  ]
}