{ "@id": "urn:uuid:2f325df8-767f-4238-a8ee-9b8a12ba2db3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 25, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:41:00.107120+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-11-05T09:41:00.107120+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 does not affect Netty 4.1.122.Final. The vulnerability affects versions before 4.1.44 and involves missing validation for HTTP headers that lack a colon separator. The upstream fix (commit a7c18d44b4 by Norman Maurer, committed 2019-12-11) was already present in the upstream 4.1.122.Final release when TuxCare onboarded it. The fix adds a check in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when nameEnd == end (no colon found in header line). This prevents malformed headers from being misinterpreted as valid headers or invalid folds, blocking potential HTTP request smuggling or header injection attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 does not affect Netty 4.1.122.Final. The vulnerability affects versions before 4.1.44 and involves missing validation for HTTP headers that lack a colon separator. The upstream fix (commit a7c18d44b4 by Norman Maurer, committed 2019-12-11) was already present in the upstream 4.1.122.Final release when TuxCare onboarded it. The fix adds a check in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when nameEnd == end (no colon found in header line). This prevents malformed headers from being misinterpreted as valid headers or invalid folds, blocking potential HTTP request smuggling or header injection attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.122.Final is NOT affected by CVE-2021-21290. The vulnerability involved insecure temporary file creation in AbstractDiskHttpData.java using File.createTempFile(), which creates world-readable files (-rw-r--r--) on Unix-like systems. The upstream fix (commit c735357bf2) replaced all File.createTempFile() calls with PlatformDependent.createTempFile(), which uses Files.createTem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 Target version 4.1.122.Final is NOT affected by CVE-2021-21290. The vulnerability involved insecure temporary file creation in AbstractDiskHttpData.java using File.createTempFile(), which creates world-readable files (-rw-r--r--) on Unix-like systems. The upstream fix (commit c735357bf2) replaced all File.createTempFile() calls with PlatformDependent.createTempFile(), which uses Files.createTem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is not a vulnerability in this target version (4.1.122.Final at SHA bcc67bddfd). The fix for this HTTP request smuggling vulnerability was already present in the upstream Netty 4.1.122.Final release that TuxCare onboarded. The vulnerable code pattern (silent stripping of control characters and non-OWS whitespace from header names) has been replaced with strict validation that thr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 is not a vulnerability in this target version (4.1.122.Final at SHA bcc67bddfd). The fix for this HTTP request smuggling vulnerability was already present in the upstream Netty 4.1.122.Final release that TuxCare onboarded. The vulnerable code pattern (silent stripping of control characters and non-OWS whitespace from header names) has been replaced with strict validation that thr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in the target repository. The vulnerability involved insecure temporary file creation in netty's multipart decoders on Java 6 and lower, where files created with directory=null would skip permission restrictions, leaving them world-readable. The upstream fix (commit 185f8b2756) eliminated the vulnerable early-return path and ensured permission-restrictive code exec...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in the target repository. The vulnerability involved insecure temporary file creation in netty's multipart decoders on Java 6 and lower, where files created with directory=null would skip permission restrictions, leaving them world-readable. The upstream fix (commit 185f8b2756) eliminated the vulnerable early-return path and ensured permission-restrictive code exec..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T08:54:00.067938+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via unvalidated header values in iterator/array set() calls) is NOT present in target Netty 4.1.122.Final. The upstream fix commit fe18adff1c, which adds validateValue() calls before adding header values from iterators/arrays, was included in upstream release 4.1.86.Final (December 2022) and was already present when TuxCare onboarded version 4.1.122.Final...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 (HTTP Response Splitting via unvalidated header values in iterator/array set() calls) is NOT present in target Netty 4.1.122.Final. The upstream fix commit fe18adff1c, which adds validateValue() calls before adding header values from iterators/arrays, was included in upstream release 4.1.86.Final (December 2022) and was already present when TuxCare onboarded version 4.1.122.Final..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-10-31T13:56:14.016146+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 is not present in target version 4.1.122.Final. The upstream fix (commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c by Norman Maurer, merged 2024-03-21) was already included in the upstream Netty 4.1.122.Final release that TuxCare onboarded on 2026-08-12. The fix adds hard limits for form field count (maxFields, default 128) and buffered bytes (maxBufferedBytes, default 1024) to pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 CVE-2024-29025 is not present in target version 4.1.122.Final. The upstream fix (commit 0d0c6ed782d13d423586ad0c71737b2c7d02058c by Norman Maurer, merged 2024-03-21) was already included in the upstream Netty 4.1.122.Final release that TuxCare onboarded on 2026-08-12. The fix adds hard limits for form field count (maxFields, default 128) and buffered bytes (maxBufferedBytes, default 1024) to pr..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42580" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55831 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56746 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59898 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59899 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59921 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.122.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.122.Final-tuxcare.3 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }