{
  "@id": "urn:uuid:3dd6a382-cb8a-4e62-88cb-f55e5c7e12f3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:11:29.632568+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before 4.1.44 and concerns HTTP headers lacking a colon separator. The target repository is Netty 4.1.101.Final, which already contains the upstream fix introduced by Norman Maurer in commit a7c18d44b4 (PR #9871). The fix validates header lines contain a colon separator at HttpObjectDecoder.java:1005-1008 and rejects malformed headers. This fix was part of the original upstream 4.1.101.Final release when TuxCare onboarded it, not a subsequent TuxCare backport. The vulnerable pattern (accepting headers without colons) is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty before 4.1.44 and concerns HTTP headers lacking a colon separator. The target repository is Netty 4.1.101.Final, which already contains the upstream fix introduced by Norman Maurer in commit a7c18d44b4 (PR #9871). The fix validates header lines contain a colon separator at HttpObjectDecoder.java:1005-1008 and rejects malformed headers. This fix was part of the original upstream 4.1.101.Final release when TuxCare onboarded it, not a subsequent TuxCare backport. The vulnerable pattern (accepting headers without colons) is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is NOT present in netty 4.1.101.Final. The vulnerability involved insecure temporary file creation using File.createTempFile() with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData, exposing uploaded multipart file content to unauthorized local users. The upstream fix (commit c735357bf2 by Norman Maurer, Feb 8 2021) replaced File.createTempFile() with PlatformDepen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is NOT present in netty 4.1.101.Final. The vulnerability involved insecure temporary file creation using File.createTempFile() with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData, exposing uploaded multipart file content to unauthorized local users. The upstream fix (commit c735357bf2 by Norman Maurer, Feb 8 2021) replaced File.createTempFile() with PlatformDepen..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.101.Final. The upstream fix (commit 07aa6b5938a by Norman Maurer, 2021-12-09) was already included in the upstream 4.1.101.Final release (2023-11-09) that TuxCare onboarded. The fix modifies HttpObjectDecoder.findNonWhitespace() to throw IllegalArgumentException when encountering control characters in HTTP header names, preventing HTTP request smugglin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.101.Final. The upstream fix (commit 07aa6b5938a by Norman Maurer, 2021-12-09) was already included in the upstream 4.1.101.Final release (2023-11-09) that TuxCare onboarded. The fix modifies HttpObjectDecoder.findNonWhitespace() to throw IllegalArgumentException when encountering control characters in HTTP header names, preventing HTTP request smugglin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in the target repository. The vulnerability concerned an insufficient fix where File.createTempFile(prefix, suffix) was called without permission adjustment when directory parameter is null on Java 6 systems, leaving temporary files world-readable. The fix (commit 185f8b2756) ensures file permissions are properly restricted in all cases by adjusting permissions wit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in the target repository. The vulnerability concerned an insufficient fix where File.createTempFile(prefix, suffix) was called without permission adjustment when directory parameter is null on Java 6 systems, leaving temporary files world-readable. The fix (commit 185f8b2756) ensures file permissions are properly restricted in all cases by adjusting permissions wit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via unvalidated iterator/array header values) is NOT present in target Netty 4.1.101.Final. The fix was already included in the upstream release that TuxCare onboarded. The vulnerable code pattern (missing validateValue calls in setObject methods taking iterators/arrays) has been remediated - validation calls are present at DefaultHeaders.java:536 and :55...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via unvalidated iterator/array header values) is NOT present in target Netty 4.1.101.Final. The fix was already included in the upstream release that TuxCare onboarded. The vulnerable code pattern (missing validateValue calls in setObject methods taking iterators/arrays) has been remediated - validation calls are present at DefaultHeaders.java:536 and :55..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-codec-http."
    }
  ]
}