{ "@id": "urn:uuid:ad01566a-379d-42cc-b717-6edc4d7605b4", "role": "Document Creator", "author": "https://tuxcare.com", "version": 24, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:40:01.312839+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-11-05T09:40:01.312839+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before 4.1.44. The target repository is running version 4.1.111.Final-tuxcare.2, which is significantly newer than the affected version range. The vulnerability involved HTTP headers lacking a colon character being incorrectly parsed. The upstream fix (commit a7c18d44b by Norman Maurer) adds validation in HttpObjectDecoder.java:splitHeader() at lines 1128-1131 to throw an IllegalArgumentException when no colon is found. This fix is present in HEAD and was already included in the upstream 4.1.111.Final release before TuxCare onboarded it. The vulnerable code pattern is not present because the upstream vendor fixed it in version 4.1.44.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 affects Netty before 4.1.44. The target repository is running version 4.1.111.Final-tuxcare.2, which is significantly newer than the affected version range. The vulnerability involved HTTP headers lacking a colon character being incorrectly parsed. The upstream fix (commit a7c18d44b by Norman Maurer) adds validation in HttpObjectDecoder.java:splitHeader() at lines 1128-1131 to throw an IllegalArgumentException when no colon is found. This fix is present in HEAD and was already included in the upstream 4.1.111.Final release before TuxCare onboarded it. The vulnerable code pattern is not present because the upstream vendor fixed it in version 4.1.44." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is NOT present in the target. The vulnerability (insecure temporary file creation with world-readable permissions) was fixed in upstream netty commit c735357bf2 by Norman Maurer, which shipped in netty-4.1.59.Final. The target version 4.1.111.Final-tuxcare.2 already contains this upstream fix. The code correctly uses PlatformDependent.createTempFile() which creates files with own...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 CVE-2021-21290 is NOT present in the target. The vulnerability (insecure temporary file creation with world-readable permissions) was fixed in upstream netty commit c735357bf2 by Norman Maurer, which shipped in netty-4.1.59.Final. The target version 4.1.111.Final-tuxcare.2 already contains this upstream fix. The code correctly uses PlatformDependent.createTempFile() which creates files with own..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is not present in target Netty 4.1.111.Final. The upstream fix (commit 07aa6b5938a8b6ed7a6586e066400e2643897323 by norman_maurer@apple.com) was already included in the upstream release 4.1.111.Final before TuxCare onboarding. The fix validates that only OWS (space/tab) whitespace is allowed in HTTP header processing and rejects control characters through token validation. Code in...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 is not present in target Netty 4.1.111.Final. The upstream fix (commit 07aa6b5938a8b6ed7a6586e066400e2643897323 by norman_maurer@apple.com) was already included in the upstream release 4.1.111.Final before TuxCare onboarding. The fix validates that only OWS (space/tab) whitespace is allowed in HTTP header processing and rejects control characters through token validation. Code in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 describes an insufficient fix for temporary file permissions in Netty's PlatformDependent.createTempFile method, where files created with directory==null lacked permission restrictions on Java 6 systems, allowing local information disclosure. The target version 4.1.111.Final contains the upstream fix from commit 185f8b2756 (author: norman_maurer@apple.com), which was first releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 CVE-2022-24823 describes an insufficient fix for temporary file permissions in Netty's PlatformDependent.createTempFile method, where files created with directory==null lacked permission restrictions on Java 6 systems, allowing local information disclosure. The target version 4.1.111.Final contains the upstream fix from commit 185f8b2756 (author: norman_maurer@apple.com), which was first releas..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T08:52:03.579487+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via missing header validation in iterator/array setObject methods) is not present in this target. The vulnerability was fixed in upstream commit fe18adff1c by adding validateValue() calls to DefaultHeaders.setObject(Iterable) and setObject(Object...) methods. This fix was already present in the upstream Netty 4.1.86.Final release, which predates the TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via missing header validation in iterator/array setObject methods) is not present in this target. The vulnerability was fixed in upstream commit fe18adff1c by adding validateValue() calls to DefaultHeaders.setObject(Iterable) and setObject(Object...) methods. This fix was already present in the upstream Netty 4.1.86.Final release, which predates the TuxCa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T13:55:54.448656+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 is not present in Netty 4.1.111.Final-tuxcare.2. The vulnerability involves unbounded memory accumulation in HttpPostRequestDecoder due to missing limits on form field count and buffered bytes. The fix (commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c by norman_maurer@apple.com) was released in upstream Netty 4.1.108.Final (March 2024) and is included in the target's 4.1.111.Final...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 CVE-2024-29025 is not present in Netty 4.1.111.Final-tuxcare.2. The vulnerability involves unbounded memory accumulation in HttpPostRequestDecoder due to missing limits on form field count and buffered bytes. The fix (commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c by norman_maurer@apple.com) was released in upstream Netty 4.1.108.Final (March 2024) and is included in the target's 4.1.111.Final..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42580" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55831 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56746 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59898 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59899 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59921 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.111.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }