{ "@id": "urn:uuid:7155458f-76d3-480f-be2d-292458ba8eb4", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T11:36:11.389267+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http. The target repository (Netty 4.1.80.Final-tuxcare.4) is not affected by CVE-2019-20444. The vulnerability pattern is not present because the upstream fix (commit a7c18d44b4 by Norman Maurer, December 2019) was already included in the upstream Netty 4.1.80.Final release that TuxCare onboarded. The fix adds validation in HttpObjectDecoder.splitHeader() to reject HTTP header lines that lack a colon character, preventing malformed headers from being accepted and processed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "The target repository (Netty 4.1.80.Final-tuxcare.4) is not affected by CVE-2019-20444. The vulnerability pattern is not present because the upstream fix (commit a7c18d44b4 by Norman Maurer, December 2019) was already included in the upstream Netty 4.1.80.Final release that TuxCare onboarded. The fix adds validation in HttpObjectDecoder.splitHeader() to reject HTTP header lines that lack a colon character, preventing malformed headers from being accepted and processed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http. not_affected \u2014 The target repository (Netty 4.1.80.Final-tuxcare.4) is NOT affected by CVE-2021-21290. The vulnerability, which involved insecure temporary file creation with world-readable permissions in multipart decoders, was fixed in upstream Netty 4.1.59.Final. The fix was already present in the 4.1.80.Final release that TuxCare onboarded. The vulnerable pattern (using File.createTempFile() with default ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.80.Final-tuxcare.4) is NOT affected by CVE-2021-21290. The vulnerability, which involved insecure temporary file creation with world-readable permissions in multipart decoders, was fixed in upstream Netty 4.1.59.Final. The fix was already present in the 4.1.80.Final release that TuxCare onboarded. The vulnerable pattern (using File.createTempFile() with default ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.80.Final. The vulnerability was fixed upstream on Dec 9, 2021 (commit 07aa6b5938), and Netty 4.1.80.Final was released on Aug 26, 2022 (8+ months after the fix). The upstream fix was included in the 4.1.80.Final release that TuxCare onboarded. The target code contains the required validation that rejects control characters (0x1c-0x1f) and non-OWS white...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 CVE-2021-43797 is NOT present in Netty 4.1.80.Final. The vulnerability was fixed upstream on Dec 9, 2021 (commit 07aa6b5938), and Netty 4.1.80.Final was released on Aug 26, 2022 (8+ months after the fix). The upstream fix was included in the 4.1.80.Final release that TuxCare onboarded. The target code contains the required validation that rejects control characters (0x1c-0x1f) and non-OWS white..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http. not_affected \u2014 The target is not affected by CVE-2022-24823. This vulnerability involves insecure temporary file creation on Java 6 and below when the directory parameter is null, creating world-readable files. The upstream fix (commit 185f8b2756) was already included in the 4.1.80.Final release that TuxCare onboarded. The fix ensures all temporary files created on Java < 7 have owner-only read permissions, r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 The target is not affected by CVE-2022-24823. This vulnerability involves insecure temporary file creation on Java 6 and below when the directory parameter is null, creating world-readable files. The upstream fix (commit 185f8b2756) was already included in the 4.1.80.Final release that TuxCare onboarded. The fix ensures all temporary files created on Java < 7 have owner-only read permissions, r..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2022-41915 is fixed in version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2022-41915" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-58056" }, "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.80.Final is NOT AFFECTED by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow protection that throws NumberFormatException for values exceeding Integer.MAX_VALUE. The attack payload \"100000004\" (hex) = 4,294,967,300 (decimal) exceeds Integer.MAX_VALUE (2,147,483,647), causing parseInt to throw an exception that is ...", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Target version 4.1.80.Final is NOT AFFECTED by CVE-2026-42580. This version uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow protection that throws NumberFormatException for values exceeding Integer.MAX_VALUE. The attack payload \"100000004\" (hex) = 4,294,967,300 (decimal) exceeds Integer.MAX_VALUE (2,147,483,647), causing parseInt to throw an exception that is ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" }, "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.1.80.Final-tuxcare.7" } } ], "timestamp": "2026-11-11T11:36:11.389267+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.80.Final-tuxcare.7 of io.netty:netty-codec-http." } ] }