{
  "@id": "urn:uuid:afc369c3-3cc8-4140-8e74-bcbf9dc515d1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2019-20444"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.29.Final is not affected by CVE-2026-42580. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow validation. When the PoC chunk size \"100000004\" (0x100000004 = 4,294,967,300) exceeds Integer.MAX_VALUE (2,147,483,647), parseInt throws NumberFormatException. The exception is caught and invalidChunk consumes the entire buffer, preventing ...",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.29.Final is not affected by CVE-2026-42580. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow validation. When the PoC chunk size \"100000004\" (0x100000004 = 4,294,967,300) exceeds Integer.MAX_VALUE (2,147,483,647), parseInt throws NumberFormatException. The exception is caught and invalidChunk consumes the entire buffer, preventing ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http. Netty 4.1.29.Final is not affected by CVE-2026-42587. This version predates the vulnerable feature: HttpContentDecompressor has no maxAllocation parameter and does not support brotli, zstd, or snappy encodings. The CVE describes a bypass of maxAllocation protection for these encodings in later versions that added this decompression bomb protection feature. Since the feature does not exist in 4.1.29.Final, the vulnerability pattern cannot manifest.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Netty 4.1.29.Final is not affected by CVE-2026-42587. This version predates the vulnerable feature: HttpContentDecompressor has no maxAllocation parameter and does not support brotli, zstd, or snappy encodings. The CVE describes a bypass of maxAllocation protection for these encodings in later versions that added this decompression bomb protection feature. Since the feature does not exist in 4.1.29.Final, the vulnerability pattern cannot manifest."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.29.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T07:08:11.874085+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.29.Final-tuxcare.4 of io.netty:netty-codec-http."
    }
  ]
}