{
  "@id": "urn:uuid:fa84c5aa-7490-4503-b54d-746d82cea2fc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T17:22:00.073535+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2. not_affected \u2014 The target Netty 4.1.75.Final is NOT vulnerable to CVE-2021-21295 (HTTP/2 request smuggling via unvalidated Content-Length). The fix was already present in the upstream release before TuxCare onboarded this version. The defense validates that cumulative HTTP/2 DATA frame bytes match the Content-Length header value, throwing PROTOCOL_ERROR on any mismatch. This prevents attackers from smuggling ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.1.75.Final is NOT vulnerable to CVE-2021-21295 (HTTP/2 request smuggling via unvalidated Content-Length). The fix was already present in the upstream release before TuxCare onboarded this version. The defense validates that cumulative HTTP/2 DATA frame bytes match the Content-Length header value, throwing PROTOCOL_ERROR on any mismatch. This prevents attackers from smuggling ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T17:27:00.166718+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in this version. The vulnerability (improper content-length validation when HTTP/2 HEADERS frame has endStream=true) was fixed by upstream Netty in version 4.1.61.Final. The target version 4.1.75.Final includes this upstream fix, which was present when TuxCare onboarded the release. The fix correctly captures the isTrailers flag before stream state changes and uses...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in this version. The vulnerability (improper content-length validation when HTTP/2 HEADERS frame has endStream=true) was fixed by upstream Netty in version 4.1.61.Final. The target version 4.1.75.Final includes this upstream fix, which was present when TuxCare onboarded the release. The fix correctly captures the isTrailers flag before stream state changes and uses..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2. already_fixed \u2014 The target repository (Netty 4.1.75.Final-tuxcare.1) already contains equivalent protection against CVE-2026-48043. While the upstream patch targets a newer architecture with a ChannelInboundHandlerAdapter tail handler (introduced in CVE-2025-58057 refactoring), the target's older architecture implements the same defensive pattern: a try-finally block ensuring ByteBuf.release() is called uncond...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.75.Final-tuxcare.1) already contains equivalent protection against CVE-2026-48043. While the upstream patch targets a newer architecture with a ChannelInboundHandlerAdapter tail handler (introduced in CVE-2025-58057 refactoring), the target's older architecture implements the same defensive pattern: a try-finally block ensuring ByteBuf.release() is called uncond..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.75.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      }
    }
  ]
}