{
  "@id": "urn:uuid:20e43943-4ec0-4072-841a-0da9dbbd8f22",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T19:36:38.301122+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 is NOT present in Netty 4.1.100.Final. The vulnerability was fixed in upstream Netty 4.1.60.Final (commit 89c241e3b1), and this fix is included in the upstream 4.1.100.Final release that TuxCare onboarded. The target code contains complete Content-Length validation in DefaultHttp2ConnectionDecoder that prevents request smuggling.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 is NOT present in Netty 4.1.100.Final. The vulnerability was fixed in upstream Netty 4.1.60.Final (commit 89c241e3b1), and this fix is included in the upstream 4.1.100.Final release that TuxCare onboarded. The target code contains complete Content-Length validation in DefaultHttp2ConnectionDecoder that prevents request smuggling."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 The target is not affected by CVE-2021-21409. The vulnerability (content-length validation bypass when HTTP/2 headers arrive in a single frame with endStream=true) is not present because the upstream fix was already included in Netty 4.1.100.Final. The fix (commit b0fa4d5aab by Norman Maurer, March 2021) introduces the `isTrailers` variable to properly track header state before stream transitio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 The target is not affected by CVE-2021-21409. The vulnerability (content-length validation bypass when HTTP/2 headers arrive in a single frame with endStream=true) is not present because the upstream fix was already included in Netty 4.1.100.Final. The fix (commit b0fa4d5aab by Norman Maurer, March 2021) introduces the `isTrailers` variable to properly track header state before stream transitio..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 Version 4.1.100.Final is not affected by CVE-2026-48043. The target uses an older architecture (pre-compression API refactor) that already has try-finally protection for buf.release() since 2016 (commit 6aa5f76d422 by Scott Mitchell). The vulnerability is specific to a newer architecture introduced after version 4.1.100.Final, where the anonymous ChannelInboundHandlerAdapter pattern temporarily...",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.100.Final is not affected by CVE-2026-48043. The target uses an older architecture (pre-compression API refactor) that already has try-finally protection for buf.release() since 2016 (commit 6aa5f76d422 by Scott Mitchell). The vulnerability is specific to a newer architecture introduced after version 4.1.100.Final, where the anonymous ChannelInboundHandlerAdapter pattern temporarily..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.100.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:36:38.301122+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.100.Final-tuxcare.4 of io.netty:netty-codec-http2."
    }
  ]
}