{
  "@id": "urn:uuid:021bbaf2-67af-4a40-ba8f-6213fedc1b94",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T10:48:03.877804+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before version 4.1.44. The target version 4.1.100.Final already contains the upstream fix that validates HTTP header lines must contain a colon character. The fix (commit a7c18d44b4) was authored by Norman Maurer and shipped in Netty 4.1.44.Final upstream release, which predates the 4.1.100.Final version that TuxCare onboarded. The vulnerable pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty before version 4.1.44. The target version 4.1.100.Final already contains the upstream fix that validates HTTP header lines must contain a colon character. The fix (commit a7c18d44b4) was authored by Norman Maurer and shipped in Netty 4.1.44.Final upstream release, which predates the 4.1.100.Final version that TuxCare onboarded. The vulnerable pattern is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is not present in netty 4.1.100.Final. The vulnerable pattern (world-readable temporary files created by File.createTempFile) has been replaced with PlatformDependent.createTempFile() which creates files with owner-only permissions. The fix was authored by Norman Maurer (norman_maurer@apple.com) in upstream commit c735357bf2 and was already included in the upstream 4.1.100.Final ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is not present in netty 4.1.100.Final. The vulnerable pattern (world-readable temporary files created by File.createTempFile) has been replaced with PlatformDependent.createTempFile() which creates files with owner-only permissions. The fix was authored by Norman Maurer (norman_maurer@apple.com) in upstream commit c735357bf2 and was already included in the upstream 4.1.100.Final ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http. not_affected \u2014 Netty 4.1.100.Final is not affected by CVE-2021-43797. The vulnerability was fixed in upstream Netty commit 07aa6b5938a8b6ed7a6586e066400e2643897323 (December 9, 2021), and this fix was already included in the upstream release 4.1.100.Final (October 10, 2023) that TuxCare onboarded. The vulnerable code pattern (silently stripping control characters from HTTP header names) is not present in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.100.Final is not affected by CVE-2021-43797. The vulnerability was fixed in upstream Netty commit 07aa6b5938a8b6ed7a6586e066400e2643897323 (December 9, 2021), and this fix was already included in the upstream release 4.1.100.Final (October 10, 2023) that TuxCare onboarded. The vulnerable code pattern (silently stripping control characters from HTTP header names) is not present in the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http. not_affected \u2014 The target Netty 4.1.100.Final is NOT affected by CVE-2022-24823. The vulnerability involves insecure temporary file creation with world-readable permissions when directory==null on Java 6. The upstream fix (commit 185f8b2756 by Norman Maurer from May 2022) was already included in the upstream 4.1.77.Final release. Since the target is at version 4.1.100.Final (> 4.1.77.Final), the fix was alrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.1.100.Final is NOT affected by CVE-2022-24823. The vulnerability involves insecure temporary file creation with world-readable permissions when directory==null on Java 6. The upstream fix (commit 185f8b2756 by Norman Maurer from May 2022) was already included in the upstream 4.1.77.Final release. Since the target is at version 4.1.100.Final (> 4.1.77.Final), the fix was alrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via missing header value validation in iterator/array overloads) is NOT affecting this target. The vulnerability was fixed in upstream Netty commit fe18adff (Dec 2022) by Chris Vest, which added validateValue() calls to DefaultHeaders.setObject(Iterable) and setObject(Object...) methods. This fix was already present in upstream Netty 4.1.100.Final when Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via missing header value validation in iterator/array overloads) is NOT affecting this target. The vulnerability was fixed in upstream Netty commit fe18adff (Dec 2022) by Chris Vest, which added validateValue() calls to DefaultHeaders.setObject(Iterable) and setObject(Object...) methods. This fix was already present in upstream Netty 4.1.100.Final when Tu..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.100.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T10:48:03.877804+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.100.Final-tuxcare.5 of io.netty:netty-codec-http."
    }
  ]
}