{
  "@id": "urn:uuid:7cd33495-594b-4f12-9268-0e740fad206e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:50:03.446715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:37:56.546685+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http. CVE-2019-20444 affects Netty before version 4.1.44. The target is Netty 4.1.68.Final, which is significantly newer than 4.1.44. The vulnerability involves HTTP headers that lack a colon separator being accepted, potentially causing header misinterpretation. The fix (commit a7c18d44b46e02dadfe3da225a06e5091f5f328e by Norman Maurer) adds validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when nameEnd == length (no colon found). This fix is present in the target at HttpObjectDecoder.java:930-933 and was shipped in the upstream 4.1.68.Final release, predating all TuxCare work on this version branch. The vulnerable pattern is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 affects Netty before version 4.1.44. The target is Netty 4.1.68.Final, which is significantly newer than 4.1.44. The vulnerability involves HTTP headers that lack a colon separator being accepted, potentially causing header misinterpretation. The fix (commit a7c18d44b46e02dadfe3da225a06e5091f5f328e by Norman Maurer) adds validation in HttpObjectDecoder.splitHeader() that throws IllegalArgumentException when nameEnd == length (no colon found). This fix is present in the target at HttpObjectDecoder.java:930-933 and was shipped in the upstream 4.1.68.Final release, predating all TuxCare work on this version branch. The vulnerable pattern is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is NOT present in the target. The vulnerability involves insecure temporary file creation with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData, allowing local users to read uploaded file contents. The upstream fix (commit c735357bf2) was already present in Netty 4.1.59.Final and shipped in the upstream 4.1.68.Final release that TuxCare onboarded. The target uses P...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is NOT present in the target. The vulnerability involves insecure temporary file creation with world-readable permissions (-rw-r--r--) in AbstractDiskHttpData, allowing local users to read uploaded file contents. The upstream fix (commit c735357bf2) was already present in Netty 4.1.59.Final and shipped in the upstream 4.1.68.Final release that TuxCare onboarded. The target uses P..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 is fixed in version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2022-24823"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:19:00.046039+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because validation, enabled by default, checks each iterable header value before storage and blocks response-splitting input. Each element is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:499. The validating converter checks every character and rejects invalid CR/LF sequences and new header names following LF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:456-514.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because validation, enabled by default, checks each iterable header value before storage and blocks response-splitting input. Each element is converted before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:499. The validating converter checks every character and rejects invalid CR/LF sequences and new header names following LF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:456-514."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:31:00.059546+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      },
      "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      },
      "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:31:00.059546+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "action_statement": "Vulnerability CVE-2026-42580 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:31:00.059546+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      },
      "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:31:00.059546+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      },
      "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:31:00.059546+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http, and is fixed in 4.1.68.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.68.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.68.Final-tuxcare.1 of io.netty:netty-codec-http."
    }
  ]
}