{ "@id": "urn:uuid:5385c6ef-bd60-4ae2-959e-4b00b78b4e32", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T09:48:00.052482+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 is not present in netty 4.2.12.Final. The vulnerability concerns HTTP/2 to HTTP/1.1 request smuggling via unvalidated Content-Length headers. The upstream Netty project fixed this in commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 (authored by norman_maurer@apple.com on 2021-03-09), which shipped in upstream release 4.2.12.Final before TuxCare's onboarding on 2026-09-12. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21295" }, "impact_statement": "not_affected \u2014 CVE-2021-21295 is not present in netty 4.2.12.Final. The vulnerability concerns HTTP/2 to HTTP/1.1 request smuggling via unvalidated Content-Length headers. The upstream Netty project fixed this in commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 (authored by norman_maurer@apple.com on 2021-03-09), which shipped in upstream release 4.2.12.Final before TuxCare's onboarding on 2026-09-12. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 concerns HTTP/2 request smuggling via improper Content-Length header validation when proxying to HTTP/1.1. The target (Netty 4.2.12.Final at SHA 96c1b01ed8) is NOT AFFECTED because the fix was already present in the upstream Netty release that TuxCare onboarded. The vulnerability was fixed by upstream commit 89c241e3b1 (authored by norman_maurer@apple.com on 2021-03-09), which ad...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 CVE-2021-21409 concerns HTTP/2 request smuggling via improper Content-Length header validation when proxying to HTTP/1.1. The target (Netty 4.2.12.Final at SHA 96c1b01ed8) is NOT AFFECTED because the fix was already present in the upstream Netty release that TuxCare onboarded. The vulnerability was fixed by upstream commit 89c241e3b1 (authored by norman_maurer@apple.com on 2021-03-09), which ad..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2025-55163 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2. CVE-2025-55163 (MadeYouReset) is NOT present in Netty 4.2.12.Final. The vulnerability allows attackers to bypass max concurrent streams limits by triggering server RST_STREAM frames through malformed HTTP/2 control frames. The upstream fix (Http2MaxRstFrameLimitEncoder rate-limiting RST frames sent by the server) was already included in the upstream 4.2.12.Final release when TuxCare onboarded it. TuxCare did not need to backport this CVE to 4.2.12.Final as it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.Alpha1, < 4.2.4.Final; < 4.1.124.Final), NVD (< 4.1.124; >= 4.2.0, < 4.2.4), cve.org (< 4.1.124.Final; < 4.2.4.Final), Snyk (< 4.1.124.Final; >= 4.2.0.Alpha1, < 4.2.4.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55163" }, "impact_statement": "CVE-2025-55163 (MadeYouReset) is NOT present in Netty 4.2.12.Final. The vulnerability allows attackers to bypass max concurrent streams limits by triggering server RST_STREAM frames through malformed HTTP/2 control frames. The upstream fix (Http2MaxRstFrameLimitEncoder rate-limiting RST frames sent by the server) was already included in the upstream 4.2.12.Final release when TuxCare onboarded it. TuxCare did not need to backport this CVE to 4.2.12.Final as it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.Alpha1, < 4.2.4.Final; < 4.1.124.Final), NVD (< 4.1.124; >= 4.2.0, < 4.2.4), cve.org (< 4.1.124.Final; < 4.2.4.Final), Snyk (< 4.1.124.Final; >= 4.2.0.Alpha1, < 4.2.4.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-33871 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2. Netty 4.2.12.Final is NOT affected by CVE-2026-33871. The vulnerability (unbounded CONTINUATION frame processing leading to DoS) is not present because the upstream Netty project shipped the complete mitigation in the 4.2.12.Final release before TuxCare onboarding. The fix (commit aae944a1 by Netty Project Bot) adds a configurable limit (default 16) on small CONTINUATION frames per headers block, preventing CPU exhaustion attacks. All defense components are present and active by default: frame counter in HeadersBlockBuilder, increment logic in addFragment(), limit check in verifyContinuationFrame() throwing ENHANCE_YOUR_CALM error, and configuration plumbing in AbstractHttp2ConnectionHandlerBuilder.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.11.Final), NVD (< 4.1.132; >= 4.2.0, < 4.2.10), cve.org (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), Snyk (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33871" }, "impact_statement": "Netty 4.2.12.Final is NOT affected by CVE-2026-33871. The vulnerability (unbounded CONTINUATION frame processing leading to DoS) is not present because the upstream Netty project shipped the complete mitigation in the 4.2.12.Final release before TuxCare onboarding. The fix (commit aae944a1 by Netty Project Bot) adds a configurable limit (default 16) on small CONTINUATION frames per headers block, preventing CPU exhaustion attacks. All defense components are present and active by default: frame counter in HeadersBlockBuilder, increment logic in addFragment(), limit check in verifyContinuationFrame() throwing ENHANCE_YOUR_CALM error, and configuration plumbing in AbstractHttp2ConnectionHandlerBuilder.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.11.Final), NVD (< 4.1.132; >= 4.2.0, < 4.2.10), cve.org (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), Snyk (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-42587 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-42587" }, "action_statement": "Vulnerability CVE-2026-42587 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-47244" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:28.122582+00:00", "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-50560" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-12T09:48:00.052482+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.2.12.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.2.12.Final-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http2." } ] }