{ "@id": "urn:uuid:7826ed38-8450-41e7-a40b-4a3669593820", "role": "Document Creator", "author": "https://tuxcare.com", "version": 29, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:41:00.107120+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-05T09:41:00.107120+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in target Netty 4.1.135.Final. The vulnerability allowed HTTP headers without colons to be accepted and misinterpreted. The upstream fix (commit a7c18d44b4) adds validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when no colon is found. This fix was already present in upstream Netty 4.1.135.Final before TuxCare onboarded it (commit a1ddbe0874). The defense is at HttpObjectDecoder.java:1148-1151 and cannot be bypassed - all HTTP request/response decoders inherit from HttpObjectDecoder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 is NOT present in target Netty 4.1.135.Final. The vulnerability allowed HTTP headers without colons to be accepted and misinterpreted. The upstream fix (commit a7c18d44b4) adds validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when no colon is found. This fix was already present in upstream Netty 4.1.135.Final before TuxCare onboarded it (commit a1ddbe0874). The defense is at HttpObjectDecoder.java:1148-1151 and cannot be bypassed - all HTTP request/response decoders inherit from HttpObjectDecoder." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 affects netty's multipart decoders (AbstractDiskHttpData) which created temporary files with insecure permissions (-rw-r--r--) using File.createTempFile(), allowing local users to read uploaded file content. The vulnerability was fixed in upstream netty 4.1.59.Final by replacing File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.createTempFile() (owne...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 CVE-2021-21290 affects netty's multipart decoders (AbstractDiskHttpData) which created temporary files with insecure permissions (-rw-r--r--) using File.createTempFile(), allowing local users to read uploaded file content. The vulnerability was fixed in upstream netty 4.1.59.Final by replacing File.createTempFile() with PlatformDependent.createTempFile(), which uses Files.createTempFile() (owne..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.135.Final. The vulnerability concerned HTTP request smuggling through improper handling of whitespace and control characters in HTTP header names. The upstream fix (commit 07aa6b5938a8b6ed7a6586e066400e2643897323 by Norman Maurer) was already included in the upstream 4.1.135.Final release that TuxCare onboarded. The fix modified HttpObjectDecoder.findN...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.135.Final. The vulnerability concerned HTTP request smuggling through improper handling of whitespace and control characters in HTTP header names. The upstream fix (commit 07aa6b5938a8b6ed7a6586e066400e2643897323 by Norman Maurer) was already included in the upstream 4.1.135.Final release that TuxCare onboarded. The fix modified HttpObjectDecoder.findN..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is not present in netty 4.1.135.Final. The vulnerability was an insufficient fix in CVE-2021-21290 where PlatformDependent.createTempFile() would create world-readable temp files when the directory parameter was null (used by multipart decoders). The target contains the complete fix from upstream commit 185f8b2756a (Norman Maurer, 2022-05-06) which ensures permission restrictions...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 CVE-2022-24823 is not present in netty 4.1.135.Final. The vulnerability was an insufficient fix in CVE-2021-21290 where PlatformDependent.createTempFile() would create world-readable temp files when the directory parameter was null (used by multipart decoders). The target contains the complete fix from upstream commit 185f8b2756a (Norman Maurer, 2022-05-06) which ensures permission restrictions..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T08:56:05.226715+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 concerns HTTP Response Splitting via missing validation in DefaultHeaders.setObject() when called with iterators/arrays. The target (Netty 4.1.135.Final-tuxcare.1) is NOT vulnerable. The upstream fix (commit fe18adff1c by Chris Vest) was released in Netty 4.1.86.Final and is present in the target version. The fix adds validateValue() calls at DefaultHeaders.java:536 and :556 that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 concerns HTTP Response Splitting via missing validation in DefaultHeaders.setObject() when called with iterators/arrays. The target (Netty 4.1.135.Final-tuxcare.1) is NOT vulnerable. The upstream fix (commit fe18adff1c by Chris Vest) was released in Netty 4.1.86.Final and is present in the target version. The fix adds validateValue() calls at DefaultHeaders.java:536 and :556 that..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T13:56:56.849680+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2024-29025 affects Netty's HttpPostRequestDecoder, which could accumulate unbounded data in two ways: (1) unlimited form fields in bodyListHttpData list, and (2) unlimited bytes in undecodedChunk buffer. The target version 4.1.135.Final is NOT AFFECTED because the upstream fix (commit 0d0c6ed782 by norman_maurer@apple.com, merged 2024-03-21) was already present in the upstream release befor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 CVE-2024-29025 affects Netty's HttpPostRequestDecoder, which could accumulate unbounded data in two ways: (1) unlimited form fields in bodyListHttpData list, and (2) unlimited bytes in undecodedChunk buffer. The target version 4.1.135.Final is NOT AFFECTED because the upstream fix (commit 0d0c6ed782 by norman_maurer@apple.com, merged 2024-03-21) was already present in the upstream release befor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T13:45:51.364036+00:00", "status_notes": "Vulnerability CVE-2025-58056 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Target Netty 4.1.135.Final is NOT AFFECTED by CVE-2025-58056 (HTTP chunked encoding request smuggling). The upstream vendor fix by Chris Vest was already included in Netty 4.1.125.Final (released September 2025) and is present in the 4.1.135.Final release that TuxCare onboarded. The fix enforces strict CR LF parsing for chunk extensions and chunk delimiters, rejecting lone LF characters that co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58056" }, "impact_statement": "not_affected \u2014 Target Netty 4.1.135.Final is NOT AFFECTED by CVE-2025-58056 (HTTP chunked encoding request smuggling). The upstream vendor fix by Chris Vest was already included in Netty 4.1.125.Final (released September 2025) and is present in the 4.1.135.Final release that TuxCare onboarded. The fix enforces strict CR LF parsing for chunk extensions and chunk delimiters, rejecting lone LF characters that co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T13:51:46.934439+00:00", "status_notes": "Vulnerability CVE-2025-67735 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2025-67735 (CRLF injection in HttpRequestEncoder) is not present in Netty 4.1.135.Final-tuxcare.1. The fix was already included in the upstream Netty 4.1.135.Final release (commit 77e81f1e59 by christianvest_hansen@apple.com) before TuxCare onboarding. The defense code validates request URIs and rejects those containing line-break characters (\\n, \\r) or spaces, preventing request smuggling ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-67735" }, "impact_statement": "not_affected \u2014 CVE-2025-67735 (CRLF injection in HttpRequestEncoder) is not present in Netty 4.1.135.Final-tuxcare.1. The fix was already included in the upstream Netty 4.1.135.Final release (commit 77e81f1e59 by christianvest_hansen@apple.com) before TuxCare onboarding. The defense code validates request URIs and rejects those containing line-break characters (\\n, \\r) or spaces, preventing request smuggling ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T12:15:19.421943+00:00", "status_notes": "Vulnerability CVE-2026-33870 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2026-33870 is not present in Netty 4.1.135.Final. The vulnerability involved incorrect parsing of HTTP/1.1 chunked transfer encoding chunk extensions containing quoted strings with embedded CR/LF bytes, enabling request smuggling. The upstream fix (commit 60e53c99f2 by Chris Vest from Apple) was included in Netty 4.1.135.Final before TuxCare onboarding. The fix adds HttpChunkLineValidatingByteProcessor which validates chunk extensions per RFC 9112, explicitly rejecting CR (0x0D) and LF (0x0A) bytes within chunk extensions. The validation is unconditionally called in HttpObjectDecoder.READ_CHUNK_SIZE state before chunk size parsing, making bypass impossible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), NVD (< 4.1.132; >= 4.2.0, < 4.2.10), cve.org (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), Snyk (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.12.Final; < 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.12.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33870" }, "impact_statement": "CVE-2026-33870 is not present in Netty 4.1.135.Final. The vulnerability involved incorrect parsing of HTTP/1.1 chunked transfer encoding chunk extensions containing quoted strings with embedded CR/LF bytes, enabling request smuggling. The upstream fix (commit 60e53c99f2 by Chris Vest from Apple) was included in Netty 4.1.135.Final before TuxCare onboarding. The fix adds HttpChunkLineValidatingByteProcessor which validates chunk extensions per RFC 9112, explicitly rejecting CR (0x0D) and LF (0x0A) bytes within chunk extensions. The validation is unconditionally called in HttpObjectDecoder.READ_CHUNK_SIZE state before chunk size parsing, making bypass impossible.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), NVD (< 4.1.132; >= 4.2.0, < 4.2.10), cve.org (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), Snyk (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.12.Final; < 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.12.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41417 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. already_fixed \u2014 The target repository version 4.1.135.Final already contains the complete fix for CVE-2026-41417. The vulnerability allowed CRLF injection through the setUri() method, bypassing constructor validation. The fix was applied via commit 6eea1bc7ef (May 4, 2026), which added validation to both setUri() and setMethod() methods to reject URI strings containing CRLF or whitespace characters. This valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41417" }, "impact_statement": "already_fixed \u2014 The target repository version 4.1.135.Final already contains the complete fix for CVE-2026-41417. The vulnerability allowed CRLF injection through the setUri() method, bypassing constructor validation. The fix was applied via commit 6eea1bc7ef (May 4, 2026), which added validation to both setUri() and setMethod() methods to reject URI strings containing CRLF or whitespace characters. This valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the exact fix for CVE-2026-42580. Vendor patch commit 756840b17c has been applied, implementing integer overflow protection in the getChunkSize method.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the exact fix for CVE-2026-42580. Vendor patch commit 756840b17c has been applied, implementing integer overflow protection in the getChunkSize method." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42581 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2026-42581. The fix was merged from upstream via commit d2475645d8 (2026-05-04), which is an ancestor of the current HEAD (445f793ae3). The vulnerability is blocked by HttpObjectDecoder rejecting HTTP/1.0 requests with Transfer-Encoding headers (throws TransferEncodingNotAllowedException) and rejecting HTTP/1....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42581" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2026-42581. The fix was merged from upstream via commit d2475645d8 (2026-05-04), which is an ancestor of the current HEAD (445f793ae3). The vulnerability is blocked by HttpObjectDecoder rejecting HTTP/1.0 requests with Transfer-Encoding headers (throws TransferEncodingNotAllowedException) and rejecting HTTP/1...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42584 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. already_fixed \u2014 CVE-2026-42584 is NOT present in the target. The target repository at version 4.1.135.Final already contains the upstream fix commit 6f69dc91a22ad4b56b8a9361a1906b17d427d99a, which implements the defense against HTTP response body misattribution in pipelined requests with 1xx informational responses. The fix was included in the upstream 4.1.135.Final release and onboarded to this TuxCare reposi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42584" }, "impact_statement": "already_fixed \u2014 CVE-2026-42584 is NOT present in the target. The target repository at version 4.1.135.Final already contains the upstream fix commit 6f69dc91a22ad4b56b8a9361a1906b17d427d99a, which implements the defense against HTTP response body misattribution in pipelined requests with 1xx informational responses. The fix was included in the upstream 4.1.135.Final release and onboarded to this TuxCare reposi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42585 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. already_fixed \u2014 The target repository Netty 4.1.135.Final already contains the fix for CVE-2026-42585. Commit 485f11d322 (dated May 4, 2026) adds validation to ensure 'chunked' is the final encoding in the Transfer-Encoding header, preventing HTTP request smuggling attacks via malformed headers like 'Transfer-Encoding: chunked, identity'.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42585" }, "impact_statement": "already_fixed \u2014 The target repository Netty 4.1.135.Final already contains the fix for CVE-2026-42585. Commit 485f11d322 (dated May 4, 2026) adds validation to ensure 'chunked' is the final encoding in the Transfer-Encoding header, preventing HTTP request smuggling attacks via malformed headers like 'Transfer-Encoding: chunked, identity'." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains all fixes from the three upstream security patches (fe702a97, 21b8493b, bf78040e) that address CVE-2026-42587. BrotliDecoder and ZstdDecoder both receive maxAllocation parameters, and BrotliDecoder enforces a 64 KiB per-buffer limit to prevent unbounded decompression.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains all fixes from the three upstream security patches (fe702a97, 21b8493b, bf78040e) that address CVE-2026-42587. BrotliDecoder and ZstdDecoder both receive maxAllocation parameters, and BrotliDecoder enforces a 64 KiB per-buffer limit to prevent unbounded decompression." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50020 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http. already_fixed \u2014 The target repository at version 4.1.135.Final already contains the complete upstream fix for CVE-2026-50020. The fix includes the new SKIP_INITIAL_LINE_CHARS state, the skipLineChars method with strict CRLF-only validation, updated documentation, and the regression test. The version 4.1.135.Final is explicitly listed as the fixed version in the CVE description.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50020" }, "impact_statement": "already_fixed \u2014 The target repository at version 4.1.135.Final already contains the complete upstream fix for CVE-2026-50020. The fix includes the new SKIP_INITIAL_LINE_CHARS state, the skipLineChars method with strict CRLF-only validation, updated documentation, and the regression test. The version 4.1.135.Final is explicitly listed as the fixed version in the CVE description." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55831 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56746 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59898 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59899 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59921 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-codec-http.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }