{
  "@id": "urn:uuid:3d215455-25ed-4be3-9770-64a5dcce6b2c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T14:09:00.038715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:39:17.792853+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http. Target Netty 4.1.87.Final already contains the upstream fix for CVE-2019-20444. The vulnerability affects Netty before 4.1.44, and this target version (4.1.87.Final) is much newer. The fix was shipped in the upstream release, not backported by TuxCare. The vulnerable pattern (accepting HTTP headers without colons) is not present in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20444"
      },
      "impact_statement": "Target Netty 4.1.87.Final already contains the upstream fix for CVE-2019-20444. The vulnerability affects Netty before 4.1.44, and this target version (4.1.87.Final) is much newer. The fix was shipped in the upstream release, not backported by TuxCare. The vulnerable pattern (accepting HTTP headers without colons) is not present in the target code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is not present in this target. The vulnerable pattern (creating temporary files with world-readable permissions via File.createTempFile()) was fixed by upstream Netty in version 4.1.59.Final. The target version 4.1.87.Final includes this upstream fix (commit c735357bf2 by norman_maurer@apple.com), which replaced File.createTempFile() with PlatformDependent.createTempFile() that u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21290"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21290 is not present in this target. The vulnerable pattern (creating temporary files with world-readable permissions via File.createTempFile()) was fixed by upstream Netty in version 4.1.59.Final. The target version 4.1.87.Final includes this upstream fix (commit c735357bf2 by norman_maurer@apple.com), which replaced File.createTempFile() with PlatformDependent.createTempFile() that u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.87.Final. The vulnerability involved HTTP header parsing that silently stripped control characters from header names instead of rejecting them, enabling HTTP request smuggling. The fix (upstream commit 07aa6b5938a8b6ed7a6586e066400e2643897323) modified `findNonWhitespace()` to unconditionally validate that only OWS (space/tab) is allowed as whitespace,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43797"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43797 is not present in Netty 4.1.87.Final. The vulnerability involved HTTP header parsing that silently stripped control characters from header names instead of rejecting them, enabling HTTP request smuggling. The fix (upstream commit 07aa6b5938a8b6ed7a6586e066400e2643897323) modified `findNonWhitespace()` to unconditionally validate that only OWS (space/tab) is allowed as whitespace,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.87.Final already contains the upstream fix for CVE-2022-24823. The vulnerability involved creating world-readable temporary files when multipart uploads were stored to disk with no custom directory specified (directory==null). The fix (commit 185f8b2756 by Norman Maurer) was introduced in Netty 4.1.77.Final and ensures file permissions are restricted to the owner for ALL temp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24823"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.87.Final already contains the upstream fix for CVE-2022-24823. The vulnerability involved creating world-readable temporary files when multipart uploads were stored to disk with no custom directory specified (directory==null). The fix (commit 185f8b2756 by Norman Maurer) was introduced in Netty 4.1.77.Final and ensures file permissions are restricted to the owner for ALL temp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T08:53:00.046847+00:00",
      "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is not present in Netty 4.1.87.Final. The vulnerability was an HTTP Response Splitting issue caused by missing header value validation when setting headers via iterator/array parameters. The upstream fix (commit fe18adff1c) was included in the Netty 4.1.87.Final release that TuxCare onboarded. The target code includes the required validateValue() calls in both setObject(Iterable)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-41915"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-41915 is not present in Netty 4.1.87.Final. The vulnerability was an HTTP Response Splitting issue caused by missing header value validation when setting headers via iterator/array parameters. The upstream fix (commit fe18adff1c) was included in the Netty 4.1.87.Final release that TuxCare onboarded. The target code includes the required validateValue() calls in both setObject(Iterable)..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2024-29025"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-58056"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2025-67735"
      },
      "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:54.717747+00:00",
      "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.87.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-33870"
      },
      "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.87.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T20:01:05.492962+00:00",
      "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.87.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41417"
      },
      "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.87.Final-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.1.87.Final uses a different parsing architecture (String-based with Integer.parseInt()) that has built-in overflow protection, unlike the vulnerable byte[] manual parsing introduced in later versions (4.1.94+). Java's Integer.parseInt(hex, 16) performs pre-multiplication overflow checks and throws NumberFormatException for values exceeding Integer.MAX_VALUE, preventing the requ...",
      "vulnerability": {
        "name": "CVE-2026-42580"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.87.Final uses a different parsing architecture (String-based with Integer.parseInt()) that has built-in overflow protection, unlike the vulnerable byte[] manual parsing introduced in later versions (4.1.94+). Java's Integer.parseInt(hex, 16) performs pre-multiplication overflow checks and throws NumberFormatException for values exceeding Integer.MAX_VALUE, preventing the requ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T20:01:22.501809+00:00",
      "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.87.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42581"
      },
      "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.87.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42584"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-42585 is fixed in version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42585"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T21:33:10.916668+00:00",
      "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.87.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-50020"
      },
      "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http, and is fixed in 4.1.87.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55831"
      },
      "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-55833"
      },
      "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56745"
      },
      "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-56746"
      },
      "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59898"
      },
      "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59899"
      },
      "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59903"
      },
      "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http@4.1.87.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T14:02:36.344309+00:00",
      "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http.",
      "vulnerability": {
        "name": "CVE-2026-59921"
      },
      "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.87.Final-tuxcare.2 of io.netty:netty-codec-http."
    }
  ]
}