{ "@id": "urn:uuid:c4ff5a25-88f3-4d1c-a895-9b0dc1bedd02", "role": "Document Creator", "author": "https://tuxcare.com", "version": 25, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:40:01.312839+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-11-05T09:40:01.312839+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 is not present in Netty 4.1.108.Final-tuxcare.3. The vulnerability allowed HTTP headers without colons to be parsed as valid headers or invalid folds. The upstream fix (commit a7c18d44b4 by Norman Maurer) added validation in HttpObjectDecoder.splitHeader() to detect and reject header lines lacking colons. This fix was already present in the upstream Netty 4.1.108.Final release when TuxCare onboarded it (first TuxCare commit: 3c75cdd3380e93d93f625c3f658c8e780798dbf5). The target version is not vulnerable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 is not present in Netty 4.1.108.Final-tuxcare.3. The vulnerability allowed HTTP headers without colons to be parsed as valid headers or invalid folds. The upstream fix (commit a7c18d44b4 by Norman Maurer) added validation in HttpObjectDecoder.splitHeader() to detect and reject header lines lacking colons. This fix was already present in the upstream Netty 4.1.108.Final release when TuxCare onboarded it (first TuxCare commit: 3c75cdd3380e93d93f625c3f658c8e780798dbf5). The target version is not vulnerable." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 The target Netty 4.1.108.Final-tuxcare.3 is NOT affected by CVE-2021-21290. The vulnerability involves insecure temporary file creation using File.createTempFile() which creates files with world-readable permissions (-rw-r--r--) on Unix-like systems, allowing local users to read sensitive uploaded file contents. The upstream Netty project fixed this in version 4.1.59.Final (Feb 2021) by introdu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 The target Netty 4.1.108.Final-tuxcare.3 is NOT affected by CVE-2021-21290. The vulnerability involves insecure temporary file creation using File.createTempFile() which creates files with world-readable permissions (-rw-r--r--) on Unix-like systems, allowing local users to read sensitive uploaded file contents. The upstream Netty project fixed this in version 4.1.59.Final (Feb 2021) by introdu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.108.Final. The upstream fix (commit 07aa6b5938a8b6ed7a6586e066400e2643897323 by norman_maurer@apple.com, dated Dec 9, 2021) was already included in the upstream release before TuxCare onboarded this version. The fix is implemented through a refactored validation architecture: (1) HttpHeaderValidationUtil.validateToken() uses a BitSet128 whitelist that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.108.Final. The upstream fix (commit 07aa6b5938a8b6ed7a6586e066400e2643897323 by norman_maurer@apple.com, dated Dec 9, 2021) was already included in the upstream release before TuxCare onboarded this version. The fix is implemented through a refactored validation architecture: (1) HttpHeaderValidationUtil.validateToken() uses a BitSet128 whitelist that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 The target repository (netty 4.1.108.Final) is NOT affected by CVE-2022-24823. The vulnerable code pattern (Java 6 temp file creation without permission restrictions) is not present. The fix was included in upstream netty-4.1.77.Final and is present in the target at lines 1505-1519 of PlatformDependent.java, where temp files always have owner-only permissions set via setReadable() calls, blocki...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 The target repository (netty 4.1.108.Final) is NOT affected by CVE-2022-24823. The vulnerable code pattern (Java 6 temp file creation without permission restrictions) is not present. The fix was included in upstream netty-4.1.77.Final and is present in the target at lines 1505-1519 of PlatformDependent.java, where temp files always have owner-only permissions set via setReadable() calls, blocki..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T08:59:00.065653+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is not present in netty 4.1.108.Final-tuxcare.3. The vulnerability (missing header value validation in DefaultHeaders.setObject() methods with Iterator/array parameters) was fixed by upstream commit fe18adff1c, which was already included in the upstream netty-4.1.108.Final release that TuxCare onboarded. The fix adds validateValue() calls at lines 536 and 556 in DefaultHeaders.ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 is not present in netty 4.1.108.Final-tuxcare.3. The vulnerability (missing header value validation in DefaultHeaders.setObject() methods with Iterator/array parameters) was fixed by upstream commit fe18adff1c, which was already included in the upstream netty-4.1.108.Final release that TuxCare onboarded. The fix adds validateValue() calls at lines 536 and 556 in DefaultHeaders.ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-31T14:01:37.177248+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 fix was already included in the upstream Netty 4.1.108.Final release. The target repository contains the complete fix: DEFAULT_MAX_FIELDS=128 and DEFAULT_MAX_BUFFERED_BYTES=1024 constants, constructors accepting these limits, enforcement checks in both HttpPostStandardRequestDecoder and HttpPostMultipartRequestDecoder that throw TooManyFormFieldsException and TooLongFormFieldExce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 CVE-2024-29025 fix was already included in the upstream Netty 4.1.108.Final release. The target repository contains the complete fix: DEFAULT_MAX_FIELDS=128 and DEFAULT_MAX_BUFFERED_BYTES=1024 constants, constructors accepting these limits, enforcement checks in both HttpPostStandardRequestDecoder and HttpPostMultipartRequestDecoder that throw TooManyFormFieldsException and TooLongFormFieldExce..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42580" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-55831 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-56746 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-59898 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-59899 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability CVE-2026-59921 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.108.Final-tuxcare.3" } } ], "timestamp": "2026-10-01T12:50:24.818091+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }