{ "@id": "urn:uuid:88ba687e-e282-4547-9619-4a08df1bbc82", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T14:10:02.605335+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-11-02T17:25:00.378854+00:00", "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 is NOT present in Netty 4.1.80.Final. The upstream fix (commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 by norman_maurer@apple.com) was already included in the 4.1.80.Final release that TuxCare onboarded. The fix adds Content-Length validation in HTTP/2 to prevent request smuggling: HttpUtil.normalizeAndGetContentLength() validates header format and sign, while DefaultHttp2Connec...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21295" }, "impact_statement": "not_affected \u2014 CVE-2021-21295 is NOT present in Netty 4.1.80.Final. The upstream fix (commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 by norman_maurer@apple.com) was already included in the 4.1.80.Final release that TuxCare onboarded. The fix adds Content-Length validation in HTTP/2 to prevent request smuggling: HttpUtil.normalizeAndGetContentLength() validates header format and sign, while DefaultHttp2Connec..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-11-02T17:30:18.916796+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in the target. The vulnerability was fixed in upstream Netty 4.1.61.Final by Norman Maurer (commit b0fa4d5aab). The target version 4.1.80.Final already includes this fix as it was part of the upstream release that TuxCare onboarded. The fix ensures content-length validation runs for all first-headers frames, even when endStream=true, preventing request smuggling at...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in the target. The vulnerability was fixed in upstream Netty 4.1.61.Final by Norman Maurer (commit b0fa4d5aab). The target version 4.1.80.Final already includes this fix as it was part of the upstream release that TuxCare onboarded. The fix ensures content-length validation runs for all first-headers frames, even when endStream=true, preventing request smuggling at..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:44:00.647233+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:43:50.334962+00:00", "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-33871" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:43:50.334962+00:00", "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-42587" }, "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:43:50.334962+00:00", "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-47244" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:43:50.334962+00:00", "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 Version 4.1.80.Final is not affected by CVE-2026-48043. The vulnerability requires a specific code pattern (anonymous ChannelInboundHandlerAdapter without try-finally around buf.release()) that was removed by upstream refactoring before 4.1.80 was released (August 2022). Version 4.1.80 implements HTTP/2 decompression with a try-finally block ensuring pooled ByteBuf is always released, even when...", "vulnerability": { "name": "CVE-2026-48043" }, "impact_statement": "not_affected \u2014 Version 4.1.80.Final is not affected by CVE-2026-48043. The vulnerability requires a specific code pattern (anonymous ChannelInboundHandlerAdapter without try-finally around buf.release()) that was removed by upstream refactoring before 4.1.80 was released (August 2022). Version 4.1.80 implements HTTP/2 decompression with a try-finally block ensuring pooled ByteBuf is always released, even when..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:43:50.334962+00:00", "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-50560" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:43:50.334962+00:00", "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-56819" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:43:50.334962+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.80.Final-tuxcare.4" } } ], "timestamp": "2026-10-27T22:43:50.334962+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.80.Final-tuxcare.4 of io.netty:netty-codec-http2." } ] }