{
  "@id": "urn:uuid:de9e4f7a-57f8-44b9-8f8b-891612355c39",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before 4.1.44 by allowing HTTP headers without colons, enabling header injection or smuggling attacks. The target version 4.1.60.Final-tuxcare.2 is not affected because the fix was already present in the upstream 4.1.43.Final release from which TuxCare onboarded this version. The fix (commit a7c18d44b4 by Norman Maurer) adds validation in HttpObjectDecoder.splitHeader() to reject headers lacking a colon separator by throwing IllegalArgumentException. Code verification confirms the fix is present at lines 893-896 of HttpObjectDecoder.java.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty before 4.1.44 by allowing HTTP headers without colons, enabling header injection or smuggling attacks. The target version 4.1.60.Final-tuxcare.2 is not affected because the fix was already present in the upstream 4.1.43.Final release from which TuxCare onboarded this version. The fix (commit a7c18d44b4 by Norman Maurer) adds validation in HttpObjectDecoder.splitHeader() to reject headers lacking a colon separator by throwing IllegalArgumentException. Code verification confirms the fix is present at lines 893-896 of HttpObjectDecoder.java."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.60.Final) is NOT AFFECTED by CVE-2021-21290. The vulnerability concerned insecure temporary file creation in AbstractDiskHttpData using File.createTempFile(), which created world-readable files on unix-like systems. The fix (replacing File.createTempFile() with PlatformDependent.createTempFile() that uses Files.createTempFile() for secure permissions) was alread...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.60.Final) is NOT AFFECTED by CVE-2021-21290. The vulnerability concerned insecure temporary file creation in AbstractDiskHttpData using File.createTempFile(), which created world-readable files on unix-like systems. The fix (replacing File.createTempFile() with PlatformDependent.createTempFile() that uses Files.createTempFile() for secure permissions) was alread..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Both public iterable setters delegate to `headers.setObject` (DefaultHttpHeaders.java:188). The iterable and array implementations convert every non-null element before storing it (DefaultHeaders.java:485, DefaultHeaders.java:503). Construction enables validation by default and installs `HeaderValueConverterAndValidator` (DefaultHttpHeaders.java:77, DefaultHttpHeaders.java:97, DefaultHttpHeaders.java:425). That converter checks every character, rejects terminal CR/LF, and rejects a new header name following CRLF, blocking the patch\u2019s response-splitting payload before insertion (DefaultHttpHeaders.java:456, DefaultHttpHeaders.java:499). Combined headers also convert and validate each iterable element through their object escaper (CombinedHttpHeaders.java:58, CombinedHttpHeaders.java:212, CombinedHttpHeaders.java:243).",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Both public iterable setters delegate to `headers.setObject` (DefaultHttpHeaders.java:188). The iterable and array implementations convert every non-null element before storing it (DefaultHeaders.java:485, DefaultHeaders.java:503). Construction enables validation by default and installs `HeaderValueConverterAndValidator` (DefaultHttpHeaders.java:77, DefaultHttpHeaders.java:97, DefaultHttpHeaders.java:425). That converter checks every character, rejects terminal CR/LF, and rejects a new header name following CRLF, blocking the patch\u2019s response-splitting payload before insertion (DefaultHttpHeaders.java:456, DefaultHttpHeaders.java:499). Combined headers also convert and validate each iterable element through their object escaper (CombinedHttpHeaders.java:58, CombinedHttpHeaders.java:212, CombinedHttpHeaders.java:243)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:55:00.066045+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.60.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:54:36.746369+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.60.Final-tuxcare.4 of io.netty:netty-codec-http."
    }
  ]
}