{
  "@id": "urn:uuid:431e36f9-db9d-43cf-959f-974f1311606f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 is NOT present in Netty 4.1.72.Final. The vulnerability involves HTTP/2 Content-Length validation missing in earlier versions, allowing request smuggling when HTTP/2 requests are converted to HTTP/1.1 and proxied. The fix (commit 89c241e3b1) was included in upstream Netty 4.1.60.Final and is present in the 4.1.72.Final release that TuxCare onboarded. The target contains complete ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 is NOT present in Netty 4.1.72.Final. The vulnerability involves HTTP/2 Content-Length validation missing in earlier versions, allowing request smuggling when HTTP/2 requests are converted to HTTP/1.1 and proxied. The fix (commit 89c241e3b1) was included in upstream Netty 4.1.60.Final and is present in the 4.1.72.Final release that TuxCare onboarded. The target contains complete ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is NOT present in Netty 4.1.72.Final. The vulnerability (improper content-length validation when HTTP/2 HEADERS frame has endStream=true) was fixed in upstream Netty 4.1.61.Final by commit b0fa4d5aab (Norman Maurer, March 2021). The target version 4.1.72.Final was released after 4.1.61.Final and already contains the fix. The fix code is present in DefaultHttp2ConnectionDecoder.ja...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is NOT present in Netty 4.1.72.Final. The vulnerability (improper content-length validation when HTTP/2 HEADERS frame has endStream=true) was fixed in upstream Netty 4.1.61.Final by commit b0fa4d5aab (Norman Maurer, March 2021). The target version 4.1.72.Final was released after 4.1.61.Final and already contains the fix. The fix code is present in DefaultHttp2ConnectionDecoder.ja..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 Version 4.1.72.Final is not affected by CVE-2026-48043. The vulnerable code pattern (anonymous ChannelInboundHandlerAdapter with unsafe buffer release when flow controller throws) was introduced in upstream commit fa97ee929d on May 6, 2025, more than 3 years after 4.1.72.Final was released on December 13, 2021. The target version predates the introduction of the vulnerable code and therefore do...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.72.Final is not affected by CVE-2026-48043. The vulnerable code pattern (anonymous ChannelInboundHandlerAdapter with unsafe buffer release when flow controller throws) was introduced in upstream commit fa97ee929d on May 6, 2025, more than 3 years after 4.1.72.Final was released on December 13, 2021. The target version predates the introduction of the vulnerable code and therefore do..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.72.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T18:32:25.058448+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.72.Final-tuxcare.3 of io.netty:netty-codec-http2."
    }
  ]
}