{
  "@id": "urn:uuid:2df33003-724e-4eb0-ae64-72bfd299e395",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:19:00.046039+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:19:09.619561+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2019-20444"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:08:20.959393+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:19:00.046039+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because header validation, enabled by default, rejects response-splitting values before storage. Multi-value setting converts every element before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:492. The validating converter accepts only space or tab after a line feed, blocking injected headers at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:494.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because header validation, enabled by default, rejects response-splitting values before storage. Multi-value setting converts every element before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:492. The validating converter accepts only space or tab after a line feed, blocking injected headers at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:494."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:19:09.619561+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:19:09.619561+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:08:20.959393+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:08:20.959393+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Version 4.1.39.Final is NOT AFFECTED by CVE-2026-42580. This version uses Java's built-in Integer.parseInt(hex, 16) for chunk size parsing, which throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerability exists only in later Netty versions (4.1.94+) that refactored to manual hex parsing with int accumulation, where the overflow check only caught negative values. The...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.39.Final is NOT AFFECTED by CVE-2026-42580. This version uses Java's built-in Integer.parseInt(hex, 16) for chunk size parsing, which throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerability exists only in later Netty versions (4.1.94+) that refactored to manual hex parsing with int accumulation, where the overflow check only caught negative values. The..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:08:20.959393+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:08:20.959393+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http. Target version Netty 4.1.39.Final is not affected by CVE-2026-42587. This version predates the vulnerable features: it does not support Brotli, Zstd, or Snappy compression for HTTP content encoding, and does not have the maxAllocation parameter. The vulnerability requires both alternative compression codec support AND the maxAllocation bypass behavior - neither exist in this version. HttpContentDecompressor and DelegatingDecompressorFrameListener only handle GZIP and DEFLATE encodings, returning null for any unsupported encoding including br/zstd/snappy.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Target version Netty 4.1.39.Final is not affected by CVE-2026-42587. This version predates the vulnerable features: it does not support Brotli, Zstd, or Snappy compression for HTTP content encoding, and does not have the maxAllocation parameter. The vulnerability requires both alternative compression codec support AND the maxAllocation bypass behavior - neither exist in this version. HttpContentDecompressor and DelegatingDecompressorFrameListener only handle GZIP and DEFLATE encodings, returning null for any unsupported encoding including br/zstd/snappy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:08:20.959393+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.39.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.39.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:18:51.285671+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-codec-http."
    }
  ]
}