{ "@id": "urn:uuid:eae25dea-2221-44c3-9449-2d4d8047850b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 4, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:06:44.318506+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2014-0193 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2014-0193" }, "action_statement": "Vulnerability CVE-2014-0193 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2015-2156 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2015-2156" }, "action_statement": "Vulnerability CVE-2015-2156 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-11-05T12:46:45.968557+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty, and is fixed in 3.5.13.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty, and is fixed in 3.5.13.Final-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T17:11:43.788711+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty, and is fixed in 3.5.13.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty, and is fixed in 3.5.13.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-21290" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-21295 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.5.13.Final does not support HTTP/2 protocol. CVE-2021-21295 requires HTTP/2-to-HTTP/1.1 conversion via Http2StreamFrameToHttpObjectCodec, which does not exist in this version. HTTP/2 support was introduced in Netty 4.1.x. The vulnerability's attack chain (HTTP/2 request with malicious Content-Length \u2192 conversion to HTTP/1.1 \u2192 request smuggling) cannot occur without HTTP/2 infrastructure...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21295" }, "impact_statement": "not_affected \u2014 Netty 3.5.13.Final does not support HTTP/2 protocol. CVE-2021-21295 requires HTTP/2-to-HTTP/1.1 conversion via Http2StreamFrameToHttpObjectCodec, which does not exist in this version. HTTP/2 support was introduced in Netty 4.1.x. The vulnerability's attack chain (HTTP/2 request with malicious Content-Length \u2192 conversion to HTTP/1.1 \u2192 request smuggling) cannot occur without HTTP/2 infrastructure..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 The target (Netty 3.5.13.Final) is not affected by CVE-2021-21409. This vulnerability is specific to HTTP/2 content-length header validation in Netty 4.x (io.netty.handler.codec.http2.DefaultHttp2ConnectionDecoder). Netty 3.x uses the org.jboss.netty package structure and only supports HTTP/1.x; it has no HTTP/2 codec implementation. The vulnerable component (HTTP/2 HEADERS frame processor) doe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 The target (Netty 3.5.13.Final) is not affected by CVE-2021-21409. This vulnerability is specific to HTTP/2 content-length header validation in Netty 4.x (io.netty.handler.codec.http2.DefaultHttp2ConnectionDecoder). Netty 3.x uses the org.jboss.netty package structure and only supports HTTP/1.x; it has no HTTP/2 codec implementation. The vulnerable component (HTTP/2 HEADERS frame processor) doe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-37136 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. Netty 3.5.13.Final (released June 2013) does not contain Bzip2 decompression functionality. CVE-2021-37136 affects Bzip2Decoder, which was first implemented in Netty 4.1.0.Beta1 timeframe (June 2014), one full year after this version's release. The target version predates the vulnerable feature entirely. The compression package contains only Zlib support (ZlibDecoder, ZlibEncoder), and package-info.java explicitly states \"TODO Implement bzip2 and lzma handlers\" (line 28). No Bzip2-related code, dependencies, or input handlers exist in the codebase. This is a clear Rule 5 Type A1 case: the Brief's INPUT (Bzip2 compressed data stream with attacker-controlled block length metadata) is not received anywhere in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37136" }, "impact_statement": "Netty 3.5.13.Final (released June 2013) does not contain Bzip2 decompression functionality. CVE-2021-37136 affects Bzip2Decoder, which was first implemented in Netty 4.1.0.Beta1 timeframe (June 2014), one full year after this version's release. The target version predates the vulnerable feature entirely. The compression package contains only Zlib support (ZlibDecoder, ZlibEncoder), and package-info.java explicitly states \"TODO Implement bzip2 and lzma handlers\" (line 28). No Bzip2-related code, dependencies, or input handlers exist in the codebase. This is a clear Rule 5 Type A1 case: the Brief's INPUT (Bzip2 compressed data stream with attacker-controlled block length metadata) is not received anywhere in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-37137 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. Netty 3.5.13.Final does not contain any Snappy compression support. The vulnerable SnappyFrameDecoder class and all related Snappy codec components (Snappy.java, SnappyFrameDecoder.java) do not exist in this version. Snappy support was introduced exclusively in Netty 4.0.0.Alpha8 (December 2012) and never backported to the 3.x line. Exhaustive verification across multiple Netty 3.x versions (3.5.13, 3.7.0, 3.9.0, 3.10.6) confirms only Zlib compression codecs exist in the 3.x series. The target cannot process Snappy frame data, therefore the CVE-2021-37137 memory exhaustion vulnerability cannot be triggered.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37137" }, "impact_statement": "Netty 3.5.13.Final does not contain any Snappy compression support. The vulnerable SnappyFrameDecoder class and all related Snappy codec components (Snappy.java, SnappyFrameDecoder.java) do not exist in this version. Snappy support was introduced exclusively in Netty 4.0.0.Alpha8 (December 2012) and never backported to the 3.x line. Exhaustive verification across multiple Netty 3.x versions (3.5.13, 3.7.0, 3.9.0, 3.10.6) confirms only Zlib compression codecs exist in the 3.x series. The target cannot process Snappy frame data, therefore the CVE-2021-37137 memory exhaustion vulnerability cannot be triggered." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-11-05T12:46:45.968557+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty, and is fixed in 3.5.13.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty, and is fixed in 3.5.13.Final-tuxcare.3." } ] }