{
  "@id": "urn:uuid:0c11aa05-864f-45cc-8a54-b4251af22348",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in target version 4.1.51.Final. The upstream fix (commit a7c18d44b4 by Norman Maurer) was shipped in Netty 4.1.51.Final before TuxCare onboarded this version. The vulnerable code pattern (accepting HTTP header lines without colons) has been replaced with a defensive check that throws IllegalArgumentException when a header line lacks a colon character. The fix is present at HttpObjectDecoder.java:883-886 and is unconditional - all HTTP header parsing paths (regular headers and trailers) invoke splitHeader which performs this validation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is NOT present in target version 4.1.51.Final. The upstream fix (commit a7c18d44b4 by Norman Maurer) was shipped in Netty 4.1.51.Final before TuxCare onboarded this version. The vulnerable code pattern (accepting HTTP header lines without colons) has been replaced with a defensive check that throws IllegalArgumentException when a header line lacks a colon character. The fix is present at HttpObjectDecoder.java:883-886 and is unconditional - all HTTP header parsing paths (regular headers and trailers) invoke splitHeader which performs this validation."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 Netty 4.1.51.Final is NOT AFFECTED by CVE-2026-42580. The target version uses Integer.parseInt(hex, 16) for chunk size parsing, which properly throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerable manual byte-array parsing with inadequate overflow checking (checking only result < 0) was introduced in upstream Netty 4.1.x on January 27, 2023 (commit 0daaec3ac2), wel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.51.Final is NOT AFFECTED by CVE-2026-42580. The target version uses Integer.parseInt(hex, 16) for chunk size parsing, which properly throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerable manual byte-array parsing with inadequate overflow checking (checking only result < 0) was introduced in upstream Netty 4.1.x on January 27, 2023 (commit 0daaec3ac2), wel..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http. Version 4.1.51.Final does not support brotli, zstd, or snappy Content-Encoding decompression. The vulnerability concerns missing maxAllocation enforcement when these encodings are processed, but this version predates the feature entirely. BrotliDecoder and ZstdDecoder do not exist in the codebase, and SnappyFrameDecoder exists only as a standalone codec without HTTP integration. When requests arrive with Content-Encoding: br/zstd/snappy, the decompressor returns null and no decompression occurs. The vulnerable code path (decompressing these encodings without size limits) cannot manifest because the decompression logic for these encodings was not added until later versions. Git history confirms CVE-2026-42587 was backported to versions 4.1.79+ but NOT to 4.1.51.Final.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Version 4.1.51.Final does not support brotli, zstd, or snappy Content-Encoding decompression. The vulnerability concerns missing maxAllocation enforcement when these encodings are processed, but this version predates the feature entirely. BrotliDecoder and ZstdDecoder do not exist in the codebase, and SnappyFrameDecoder exists only as a standalone codec without HTTP integration. When requests arrive with Content-Encoding: br/zstd/snappy, the decompressor returns null and no decompression occurs. The vulnerable code path (decompressing these encodings without size limits) cannot manifest because the decompression logic for these encodings was not added until later versions. Git history confirms CVE-2026-42587 was backported to versions 4.1.79+ but NOT to 4.1.51.Final."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.51.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:57:48.287417+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.51.Final-tuxcare.4 of io.netty:netty-codec-http."
    }
  ]
}