{ "@id": "urn:uuid:f14f28d6-8c84-4752-9abe-1757665b9997", "role": "Document Creator", "author": "https://tuxcare.com", "version": 7, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:06:44.318506+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-11-01T15:25:00.106741+00:00", "status_notes": "Vulnerability CVE-2014-0193 does not affect version 3.10.6.Final-tuxcare.2 of io.netty:netty. not_affected \u2014 CVE-2014-0193: Target Netty 3.10.6.Final is NOT AFFECTED. The vulnerable unbounded text accumulation pattern (WebSocket08FrameDecoder.fragmentedFramesText field accumulating continuation frame text into a StringBuilder without size limits) was removed by upstream fix commit 48edb7802b in the release. The decoder now uses Utf8Validator (validation-only, no accumulation) instead of UTF8Output (st...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0193" }, "impact_statement": "not_affected \u2014 CVE-2014-0193: Target Netty 3.10.6.Final is NOT AFFECTED. The vulnerable unbounded text accumulation pattern (WebSocket08FrameDecoder.fragmentedFramesText field accumulating continuation frame text into a StringBuilder without size limits) was removed by upstream fix commit 48edb7802b in the release. The decoder now uses Utf8Validator (validation-only, no accumulation) instead of UTF8Output (st..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:48:57.330318+00:00", "status_notes": "Vulnerability CVE-2015-2156 does not affect version 3.10.6.Final-tuxcare.2 of io.netty:netty. CVE-2015-2156 is NOT present in Netty 3.10.6.Final-tuxcare.3. The vulnerability (missing RFC6265 cookie character validation allowing httpOnly bypass via header injection) was fixed by upstream commit 402edce586 authored by Stephane Landelle and shipped in Netty 3.10.2.Final. TuxCare onboarded 3.10.6.Final which already contained this upstream fix. The fix introduces CookieUtil validation methods (firstInvalidCookieNameOctet, firstInvalidCookieValueOctet) that reject control characters, semicolons, and other RFC6265-disallowed characters in cookie names/values. Both the new RFC6265-compliant cookie package and the deprecated legacy cookie classes use these validation methods, providing comprehensive protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.10.0, < 3.10.3.Final; < 3.9.8.Final), NVD (<= 3.9.7; = 3.10.0; = 3.10.1; = 3.10.2; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.0.10; = 4.0.11; = 4.0.12; = 4.0.13; = 4.0.14; = 4.0.15; = 4.0.16; = 4.0.17; = 4.0.18; = 4.0.19; = 4.0.20; = 4.0.21; = 4.0.22; = 4.0.23; = 4.0.24; = 4.0.25; = 4.0.26; = 4.0.27; = 4.1.0-beta1; = 4.1.0-beta2; = 4.1.0-beta3; = 4.1.0-beta4), Snyk (>= 3.3.0.Final, < 3.9.8.Final; >= 3.10.0.Final, < 3.10.3.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-2156" }, "impact_statement": "CVE-2015-2156 is NOT present in Netty 3.10.6.Final-tuxcare.3. The vulnerability (missing RFC6265 cookie character validation allowing httpOnly bypass via header injection) was fixed by upstream commit 402edce586 authored by Stephane Landelle and shipped in Netty 3.10.2.Final. TuxCare onboarded 3.10.6.Final which already contained this upstream fix. The fix introduces CookieUtil validation methods (firstInvalidCookieNameOctet, firstInvalidCookieValueOctet) that reject control characters, semicolons, and other RFC6265-disallowed characters in cookie names/values. Both the new RFC6265-compliant cookie package and the deprecated legacy cookie classes use these validation methods, providing comprehensive protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.10.0, < 3.10.3.Final; < 3.9.8.Final), NVD (<= 3.9.7; = 3.10.0; = 3.10.1; = 3.10.2; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.0.5; = 4.0.6; = 4.0.7; = 4.0.8; = 4.0.9; = 4.0.10; = 4.0.11; = 4.0.12; = 4.0.13; = 4.0.14; = 4.0.15; = 4.0.16; = 4.0.17; = 4.0.18; = 4.0.19; = 4.0.20; = 4.0.21; = 4.0.22; = 4.0.23; = 4.0.24; = 4.0.25; = 4.0.26; = 4.0.27; = 4.1.0-beta1; = 4.1.0-beta2; = 4.1.0-beta3; = 4.1.0-beta4), Snyk (>= 3.3.0.Final, < 3.9.8.Final; >= 3.10.0.Final, < 3.10.3.Final)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-16869 is fixed in version 3.10.6.Final-tuxcare.2 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-16869" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 3.10.6.Final-tuxcare.2 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-20445 is fixed in version 3.10.6.Final-tuxcare.2 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20445" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 3.10.6.Final-tuxcare.2 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-21290" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 3.10.6.Final-tuxcare.2 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 3.10.6.Final-tuxcare.2 of io.netty:netty." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 3.10.6.Final-tuxcare.2 of io.netty:netty. not_affected \u2014 Netty 3.10.6.Final is not affected by CVE-2021-21409. This CVE specifically concerns HTTP/2 content-length validation in Http2HeaderFrame processing when endStream=true. Netty 3.x (package org.jboss.netty.*) predates HTTP/2 support and has no HTTP/2 codec implementation. The vulnerability requires processing HTTP/2 frames, which Netty 3.x cannot do. While Netty 3.x includes SPDY support (HTTP/2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 Netty 3.10.6.Final is not affected by CVE-2021-21409. This CVE specifically concerns HTTP/2 content-length validation in Http2HeaderFrame processing when endStream=true. Netty 3.x (package org.jboss.netty.*) predates HTTP/2 support and has no HTTP/2 codec implementation. The vulnerability requires processing HTTP/2 frames, which Netty 3.x cannot do. While Netty 3.x includes SPDY support (HTTP/2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-37136 does not affect version 3.10.6.Final-tuxcare.2 of io.netty:netty. Target repository Netty 3.10.6.Final is NOT AFFECTED by CVE-2021-37136. The vulnerability concerns the Bzip2Decoder component which was introduced exclusively in Netty 4.x and never existed in Netty 3.x. Netty 3.x uses the org.jboss.netty package structure and contains only Zlib compression codecs (ZlibDecoder, ZlibEncoder). The Bzip2Decoder class (package io.netty.handler.codec.compression) was introduced in commit f9021a6061 on 2014-06-17 as part of Netty 4.1.0.Alpha1-SNAPSHOT, well after the 3.x lineage diverged. Exhaustive search confirmed no Bzip2-related code exists in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37136" }, "impact_statement": "Target repository Netty 3.10.6.Final is NOT AFFECTED by CVE-2021-37136. The vulnerability concerns the Bzip2Decoder component which was introduced exclusively in Netty 4.x and never existed in Netty 3.x. Netty 3.x uses the org.jboss.netty package structure and contains only Zlib compression codecs (ZlibDecoder, ZlibEncoder). The Bzip2Decoder class (package io.netty.handler.codec.compression) was introduced in commit f9021a6061 on 2014-06-17 as part of Netty 4.1.0.Alpha1-SNAPSHOT, well after the 3.x lineage diverged. Exhaustive search confirmed no Bzip2-related code exists in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-37137 does not affect version 3.10.6.Final-tuxcare.2 of io.netty:netty. CVE-2021-37137 concerns SnappyFrameDecoder in Netty 4.x, which does not exist in Netty 3.10.6.Final. Snappy compression support was introduced in Netty 4.0.0.Beta1 and is absent from the entire 3.x architecture. The target uses package org.jboss.netty with only Zlib/Gzip compression codecs. Exhaustive searches found zero Snappy-related code, dependencies, or vendored copies. Git history confirms CVE-2021-37137 was backported only to 4.1.x branches (4.1.48+), never to 3.10.6.Final, because the vulnerable component does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37137" }, "impact_statement": "CVE-2021-37137 concerns SnappyFrameDecoder in Netty 4.x, which does not exist in Netty 3.10.6.Final. Snappy compression support was introduced in Netty 4.0.0.Beta1 and is absent from the entire 3.x architecture. The target uses package org.jboss.netty with only Zlib/Gzip compression codecs. Exhaustive searches found zero Snappy-related code, dependencies, or vendored copies. Git history confirms CVE-2021-37137 was backported only to 4.1.x branches (4.1.48+), never to 3.10.6.Final, because the vulnerable component does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.10.6.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 3.10.6.Final-tuxcare.2 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-43797" } } ] }