{
  "@id": "urn:uuid:6ccfbeeb-1ac5-4e3d-b41f-4c2ba3a69e69",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T11:38:55.157382+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:40:01.312839+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty versions before 4.1.44. The target version 4.1.118.Final already contains the upstream fix (commit a7c18d44b4 by norman_maurer@apple.com) that was shipped with Netty 4.1.44 in December 2019. The fix adds validation in HttpObjectDecoder.splitHeader() to detect and reject HTTP headers that lack a colon separator, preventing header parsing confusion. This upstream fix was present in the 4.1.118.Final release that TuxCare onboarded, making the target not affected by this vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty versions before 4.1.44. The target version 4.1.118.Final already contains the upstream fix (commit a7c18d44b4 by norman_maurer@apple.com) that was shipped with Netty 4.1.44 in December 2019. The fix adds validation in HttpObjectDecoder.splitHeader() to detect and reject HTTP headers that lack a colon separator, preventing header parsing confusion. This upstream fix was present in the 4.1.118.Final release that TuxCare onboarded, making the target not affected by this vulnerability."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.118.Final-tuxcare.1) is not affected by CVE-2021-21290. The vulnerable code pattern (File.createTempFile() creating world-readable temporary files with -rw-r--r-- permissions) was replaced by PlatformDependent.createTempFile() which creates files with secure owner-only permissions. This fix was already present in the upstream Netty 4.1.118.Final release (commit ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.118.Final-tuxcare.1) is not affected by CVE-2021-21290. The vulnerable code pattern (File.createTempFile() creating world-readable temporary files with -rw-r--r-- permissions) was replaced by PlatformDependent.createTempFile() which creates files with secure owner-only permissions. This fix was already present in the upstream Netty 4.1.118.Final release (commit ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target Netty 4.1.118.Final is NOT affected by CVE-2021-43797. The upstream fix commit 07aa6b5938 (authored by Norman Maurer in December 2021) was already included in the upstream Netty 4.1.118.Final release (February 2025) before TuxCare onboarded it. The fix correctly validates that only OWS (Optional WhiteSpace: space 0x20 and tab 0x09) is allowed as whitespace around HTTP header names, r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.1.118.Final is NOT affected by CVE-2021-43797. The upstream fix commit 07aa6b5938 (authored by Norman Maurer in December 2021) was already included in the upstream Netty 4.1.118.Final release (February 2025) before TuxCare onboarded it. The fix correctly validates that only OWS (Optional WhiteSpace: space 0x20 and tab 0x09) is allowed as whitespace around HTTP header names, r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in the target. The vulnerability was an insufficient fix from CVE-2021-21290 where temporary files created via File.createTempFile(prefix, suffix) when directory==null on Java 6 had world-readable permissions. The upstream fix (commit 185f8b2756) restructured the code to ensure BOTH paths apply restrictive permissions. This fix was already present in the upstream n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in the target. The vulnerability was an insufficient fix from CVE-2021-21290 where temporary files created via File.createTempFile(prefix, suffix) when directory==null on Java 6 had world-readable permissions. The upstream fix (commit 185f8b2756) restructured the code to ensure BOTH paths apply restrictive permissions. This fix was already present in the upstream n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.118.Final) is not affected by CVE-2022-41915. The vulnerability involved missing header value validation when calling DefaultHttpHeaders.set() with an iterator or array of values, allowing HTTP Response Splitting attacks via CRLF injection. The fix was introduced in upstream Netty 4.1.86.Final (commit fe18adff1c by Chris Vest) and is present in the 4.1.118.Final...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.118.Final) is not affected by CVE-2022-41915. The vulnerability involved missing header value validation when calling DefaultHttpHeaders.set() with an iterator or array of values, allowing HTTP Response Splitting attacks via CRLF injection. The fix was introduced in upstream Netty 4.1.86.Final (commit fe18adff1c by Chris Vest) and is present in the 4.1.118.Final..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target repository io.netty:netty-parent:4.1.118.Final-tuxcare.1 is NOT affected by CVE-2024-29025. The vulnerability (unbounded memory accumulation in HttpPostRequestDecoder via unlimited fields in bodyListHttpData list and unlimited bytes in undecodedChunk buffer) has been fixed by the upstream vendor. The fix, authored by norman_maurer@apple.com in commit 0d0c6ed782, was already present i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "impact_statement": "not_affected \u2014 The target repository io.netty:netty-parent:4.1.118.Final-tuxcare.1 is NOT affected by CVE-2024-29025. The vulnerability (unbounded memory accumulation in HttpPostRequestDecoder via unlimited fields in bodyListHttpData list and unlimited bytes in undecodedChunk buffer) has been fixed by the upstream vendor. The fix, authored by norman_maurer@apple.com in commit 0d0c6ed782, was already present i..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:18.776800+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.118.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.118.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T11:38:55.157382+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.118.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.118.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:41.871025+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:41.871025+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.118.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:10:13.564095+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.118.Final-tuxcare.2 of io.netty:netty-codec-http."
    }
  ]
}