{
  "@id": "urn:uuid:3f6eedc4-3eb3-441e-b9c8-e04740fbc945",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:19:00.046039+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T09:38:47.406690+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http. CVE-2019-20444 is NOT present in target Netty 4.1.79.Final-tuxcare.5. The vulnerability allowed HTTP headers lacking a colon to be misinterpreted, enabling header injection. The fix (commit a7c18d44b4 by Norman Maurer) validates that each header line contains a colon separator and rejects malformed headers with IllegalArgumentException. This fix was shipped in upstream Netty 4.1.44 and was already present when TuxCare onboarded version 4.1.79.Final. The defense code is active at HttpObjectDecoder.java:987-990 and applies to all HTTP header parsing paths.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "CVE-2019-20444 is NOT present in target Netty 4.1.79.Final-tuxcare.5. The vulnerability allowed HTTP headers lacking a colon to be misinterpreted, enabling header injection. The fix (commit a7c18d44b4 by Norman Maurer) validates that each header line contains a colon separator and rejects malformed headers with IllegalArgumentException. This fix was shipped in upstream Netty 4.1.44 and was already present when TuxCare onboarded version 4.1.79.Final. The defense code is active at HttpObjectDecoder.java:987-990 and applies to all HTTP header parsing paths."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is NOT present in target version 4.1.79.Final. The vulnerability (insecure temporary file creation with world-readable permissions) was fixed by upstream Netty in commit c735357bf29d07856ad171c6611a2e1a0e0000ec (released in 4.1.59.Final). The target version 4.1.79.Final includes this upstream fix. The vulnerable code pattern (File.createTempFile with insecure permissions) has bee...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is NOT present in target version 4.1.79.Final. The vulnerability (insecure temporary file creation with world-readable permissions) was fixed by upstream Netty in commit c735357bf29d07856ad171c6611a2e1a0e0000ec (released in 4.1.59.Final). The target version 4.1.79.Final includes this upstream fix. The vulnerable code pattern (File.createTempFile with insecure permissions) has bee..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.79.Final-tuxcare.5. The vulnerability (control characters in HTTP header names being stripped instead of rejected, enabling HTTP request smuggling) was fixed in upstream commit 07aa6b5938 (December 9, 2021) by Norman Maurer. This fix was already included in the upstream 4.1.79.Final release that TuxCare onboarded. The target code correctly validates th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.79.Final-tuxcare.5. The vulnerability (control characters in HTTP header names being stripped instead of rejected, enabling HTTP request smuggling) was fixed in upstream commit 07aa6b5938 (December 9, 2021) by Norman Maurer. This fix was already included in the upstream 4.1.79.Final release that TuxCare onboarded. The target code correctly validates th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-24823 is NOT present in the target. The vulnerability involved insecure temporary file permissions when Netty's multipart decoders create temp files on Java 6 with directory==null, allowing local information disclosure. The upstream fix (commit 185f8b2756) was released in Netty 4.1.77.Final (May 2022). The target version 4.1.79.Final-tuxcare.5 is based on 4.1.79.Final (July 2022), whic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-24823 is NOT present in the target. The vulnerability involved insecure temporary file permissions when Netty's multipart decoders create temp files on Java 6 with directory==null, allowing local information disclosure. The upstream fix (commit 185f8b2756) was released in Netty 4.1.77.Final (May 2022). The target version 4.1.79.Final-tuxcare.5 is based on 4.1.79.Final (July 2022), whic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:19:00.046039+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because header values are validated before insertion, blocking response splitting with validation enabled by default. The multi-value set loop converts every value before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:488. The converter rejects trailing CR/LF and a new header or blank line following CRLF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:503.",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because header values are validated before insertion, blocking response splitting with validation enabled by default. The multi-value set loop converts every value before insertion at codec/src/main/java/io/netty/handler/codec/DefaultHeaders.java:488. The converter rejects trailing CR/LF and a new header or blank line following CRLF at codec-http/src/main/java/io/netty/handler/codec/http/DefaultHttpHeaders.java:503."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.79.Final is not affected by CVE-2026-42580. The vulnerable code pattern (manual int accumulation in getChunkSize with insufficient overflow checking) was introduced in February 2023, well after 4.1.79.Final was released in July 2022. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which properly throws NumberFormatException when values exceed Integer.MAX_VAL...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.79.Final is not affected by CVE-2026-42580. The vulnerable code pattern (manual int accumulation in getChunkSize with insufficient overflow checking) was introduced in February 2023, well after 4.1.79.Final was released in July 2022. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which properly throws NumberFormatException when values exceed Integer.MAX_VAL..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.79.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.79.Final-tuxcare.3 of io.netty:netty-codec-http, and is fixed in 4.1.79.Final-tuxcare.4."
    }
  ]
}