{ "@id": "urn:uuid:58abb250-d71d-4023-9f45-b4db7bfceff4", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T06:39:19.132948+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http. CVE-2019-20444: Target version 4.1.113.Final is NOT AFFECTED. The vulnerability (missing colon validation in HTTP header parsing) was fixed in upstream Netty 4.1.44 via commit a7c18d44b4 authored by Norman Maurer. This fix was already present in the upstream 4.1.113.Final release when TuxCare onboarded it (commit 5ec21010e9). The vulnerable code pattern is not present in the target; the required validation check exists at HttpObjectDecoder.java:1057-1060.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444: Target version 4.1.113.Final is NOT AFFECTED. The vulnerability (missing colon validation in HTTP header parsing) was fixed in upstream Netty 4.1.44 via commit a7c18d44b4 authored by Norman Maurer. This fix was already present in the upstream 4.1.113.Final release when TuxCare onboarded it (commit 5ec21010e9). The vulnerable code pattern is not present in the target; the required validation check exists at HttpObjectDecoder.java:1057-1060." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.113.Final-tuxcare.1) is NOT affected by CVE-2021-21290. The upstream Netty project fixed this vulnerability in commit c735357bf29d07856ad171c6611a2e1a0e0000ec (February 2021) by replacing File.createTempFile with PlatformDependent.createTempFile, which uses Files.createTempFile on Java 7+ to create temporary files with secure owner-only permissions. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.113.Final-tuxcare.1) is NOT affected by CVE-2021-21290. The upstream Netty project fixed this vulnerability in commit c735357bf29d07856ad171c6611a2e1a0e0000ec (February 2021) by replacing File.createTempFile with PlatformDependent.createTempFile, which uses Files.createTempFile on Java 7+ to create temporary files with secure owner-only permissions. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.113.Final. The vulnerability (accepting control characters and non-OWS whitespace in HTTP header names, enabling request smuggling) was fixed by upstream commit 07aa6b5938a8 authored by Norman Maurer, which shipped in the upstream 4.1.113.Final release that TuxCare onboarded. The fix implements strict header name validation via HttpHeaderValidationUtil...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.113.Final. The vulnerability (accepting control characters and non-OWS whitespace in HTTP header names, enabling request smuggling) was fixed by upstream commit 07aa6b5938a8 authored by Norman Maurer, which shipped in the upstream 4.1.113.Final release that TuxCare onboarded. The fix implements strict header name validation via HttpHeaderValidationUtil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in target version 4.1.113.Final. The vulnerability (insecure temp file creation allowing local information disclosure) was fixed in upstream commit 185f8b2756 by Norman Maurer, which was already included in the Netty 4.1.113.Final release when TuxCare onboarded it. The vulnerable code pattern (early return without permission adjustment when directory==null) is abse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in target version 4.1.113.Final. The vulnerability (insecure temp file creation allowing local information disclosure) was fixed in upstream commit 185f8b2756 by Norman Maurer, which was already included in the Netty 4.1.113.Final release when TuxCare onboarded it. The vulnerable code pattern (early return without permission adjustment when directory==null) is abse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 affects DefaultHeaders.setObject() methods that accept iterator/array values, allowing HTTP Response Splitting via unvalidated CRLF sequences. The target repository (Netty 4.1.113.Final) is NOT affected because the upstream fix was already present in the 4.1.113.Final release that TuxCare onboarded. The fix (commit fe18adff1c by Chris Vest from Apple) added validateValue() calls ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 affects DefaultHeaders.setObject() methods that accept iterator/array values, allowing HTTP Response Splitting via unvalidated CRLF sequences. The target repository (Netty 4.1.113.Final) is NOT affected because the upstream fix was already present in the 4.1.113.Final release that TuxCare onboarded. The fix (commit fe18adff1c by Chris Vest from Apple) added validateValue() calls ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.113.Final) is NOT affected by CVE-2024-29025. The vulnerability was fixed in upstream Netty commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c (March 21, 2024), which was included in Netty 4.1.108.Final. Since 4.1.113.Final is a later release, it inherited the fix from upstream before TuxCare onboarded this version. The fix adds two hard limits: maxFields (default ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.113.Final) is NOT affected by CVE-2024-29025. The vulnerability was fixed in upstream Netty commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c (March 21, 2024), which was included in Netty 4.1.108.Final. Since 4.1.113.Final is a later release, it inherited the fix from upstream before TuxCare onboarded this version. The fix adds two hard limits: maxFields (default ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42580" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" }, "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.113.Final-tuxcare.4" } } ], "timestamp": "2026-11-10T06:39:19.132948+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.113.Final-tuxcare.4 of io.netty:netty-codec-http." } ] }