{
  "@id": "urn:uuid:bc3bb638-cb9d-40c4-a558-d37d6481397b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:06:44.318506+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2. Target version 4.1.59.Final predates the vulnerable feature entirely. The CVE describes a vulnerability where BrotliDecoder and ZstdDecoder ignore the maxAllocation parameter, allowing decompression bomb attacks to bypass configured limits. However, this version: (1) does not contain BrotliDecoder or ZstdDecoder classes at all, (2) does not support brotli/zstd/snappy Content-Encoding in HttpContentDecompressor or DelegatingDecompressorFrameListener (both only handle gzip/deflate and return null for unsupported encodings), and (3) does not have the maxAllocation feature in HTTP decompression handlers that the CVE describes being bypassed. The specific attack vector (sending Content-Encoding: br instead of gzip to bypass maxAllocation) cannot exist because neither the decoders nor the maxAllocation feature are present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Target version 4.1.59.Final predates the vulnerable feature entirely. The CVE describes a vulnerability where BrotliDecoder and ZstdDecoder ignore the maxAllocation parameter, allowing decompression bomb attacks to bypass configured limits. However, this version: (1) does not contain BrotliDecoder or ZstdDecoder classes at all, (2) does not support brotli/zstd/snappy Content-Encoding in HttpContentDecompressor or DelegatingDecompressorFrameListener (both only handle gzip/deflate and return null for unsupported encodings), and (3) does not have the maxAllocation feature in HTTP decompression handlers that the CVE describes being bypassed. The specific attack vector (sending Content-Encoding: br instead of gzip to bypass maxAllocation) cannot exist because neither the decoders nor the maxAllocation feature are present."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      },
      "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http2."
    }
  ]
}