{
  "@id": "urn:uuid:6a105bec-d5a8-4f22-8e5e-203314da99ba",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:06:44.318506+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:37:56.546685+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in target Netty 4.1.59.Final. The vulnerability affects Netty before 4.1.44, allowing HTTP headers without colons to be misinterpreted. The fix (commit a7c18d44b4 by Norman Maurer) added validation in HttpObjectDecoder.splitHeader() to throw IllegalArgumentException when no colon is found. This fix is present at lines 927-930 and shipped in upstream 4.1.59.Final before TuxCare onboarded it (commit d87476fc0a). All HTTP header parsing paths (lines 650, 835) invoke the protected splitHeader method, ensuring comprehensive coverage.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is NOT present in target Netty 4.1.59.Final. The vulnerability affects Netty before 4.1.44, allowing HTTP headers without colons to be misinterpreted. The fix (commit a7c18d44b4 by Norman Maurer) added validation in HttpObjectDecoder.splitHeader() to throw IllegalArgumentException when no colon is found. This fix is present at lines 927-930 and shipped in upstream 4.1.59.Final before TuxCare onboarded it (commit d87476fc0a). All HTTP header parsing paths (lines 650, 835) invoke the protected splitHeader method, ensuring comprehensive coverage."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290: The target version 4.1.59.Final is NOT affected. The vulnerability involved insecure temporary file creation using File.createTempFile() which creates world-readable files on Unix-like systems. The upstream fix (commit c735357bf2 by norman_maurer@apple.com, dated 2021-02-08) replaced File.createTempFile() with PlatformDependent.createTempFile() that uses Files.createTempFile() t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290: The target version 4.1.59.Final is NOT affected. The vulnerability involved insecure temporary file creation using File.createTempFile() which creates world-readable files on Unix-like systems. The upstream fix (commit c735357bf2 by norman_maurer@apple.com, dated 2021-02-08) replaced File.createTempFile() with PlatformDependent.createTempFile() that uses Files.createTempFile() t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:20:04.842645+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default header validation blocks CR/LF injection before values are stored. Each value in an iterable is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:496. Validation is enabled by default at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:77, and the converter rejects CR/LF sequences that would introduce another header at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:448.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because default header validation blocks CR/LF injection before values are stored. Each value in an iterable is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:496. Validation is enabled by default at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:77, and the converter rejects CR/LF sequences that would introduce another header at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:448."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 Netty 4.1.59.Final is NOT affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow protection that throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerable manual parsing loop (result *= 16; if (result < 0)) was introduced later in v4.1.89.Final as a performance optimization. Version 4.1.59.Final preda...",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.59.Final is NOT affected by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow protection that throws NumberFormatException for values exceeding Integer.MAX_VALUE. The vulnerable manual parsing loop (result *= 16; if (result < 0)) was introduced later in v4.1.89.Final as a performance optimization. Version 4.1.59.Final preda..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:28:00.086673+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.59.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.59.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:31.468347+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.59.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.59.Final-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http. Target version 4.1.59.Final predates the vulnerable feature entirely. The CVE describes a vulnerability where BrotliDecoder and ZstdDecoder ignore the maxAllocation parameter, allowing decompression bomb attacks to bypass configured limits. However, this version: (1) does not contain BrotliDecoder or ZstdDecoder classes at all, (2) does not support brotli/zstd/snappy Content-Encoding in HttpContentDecompressor or DelegatingDecompressorFrameListener (both only handle gzip/deflate and return null for unsupported encodings), and (3) does not have the maxAllocation feature in HTTP decompression handlers that the CVE describes being bypassed. The specific attack vector (sending Content-Encoding: br instead of gzip to bypass maxAllocation) cannot exist because neither the decoders nor the maxAllocation feature are present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Target version 4.1.59.Final predates the vulnerable feature entirely. The CVE describes a vulnerability where BrotliDecoder and ZstdDecoder ignore the maxAllocation parameter, allowing decompression bomb attacks to bypass configured limits. However, this version: (1) does not contain BrotliDecoder or ZstdDecoder classes at all, (2) does not support brotli/zstd/snappy Content-Encoding in HttpContentDecompressor or DelegatingDecompressorFrameListener (both only handle gzip/deflate and return null for unsupported encodings), and (3) does not have the maxAllocation feature in HTTP decompression handlers that the CVE describes being bypassed. The specific attack vector (sending Content-Encoding: br instead of gzip to bypass maxAllocation) cannot exist because neither the decoders nor the maxAllocation feature are present."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:28:00.086673+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.59.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.59.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.59.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T16:39:37.339465+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.59.Final-tuxcare.1 of io.netty:netty-codec-http."
    }
  ]
}