{
  "@id": "urn:uuid:8f685e64-15cf-443d-8c91-5a81a0828e29",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T11:11:29.632568+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 (HTTP/2 request smuggling via unvalidated Content-Length headers) is NOT present in Netty 4.1.101.Final. The vulnerability was fixed in upstream Netty 4.1.60.Final, and version 4.1.101.Final includes this fix. The target contains complete Content-Length validation logic that prevents request smuggling attacks during HTTP/2 to HTTP/1.1 conversion.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 (HTTP/2 request smuggling via unvalidated Content-Length headers) is NOT present in Netty 4.1.101.Final. The vulnerability was fixed in upstream Netty 4.1.60.Final, and version 4.1.101.Final includes this fix. The target contains complete Content-Length validation logic that prevents request smuggling attacks during HTTP/2 to HTTP/1.1 conversion."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is NOT present in target version 4.1.101.Final. The vulnerability (HTTP/2 content-length validation bypass when endStream=true) was fixed by upstream commit b0fa4d5aab in March 2021 as part of Netty 4.1.61.Final. Since the target version is 4.1.101.Final (released later), the fix was already present in the upstream release when TuxCare onboarded it in October 2026. The fix (isTra...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is NOT present in target version 4.1.101.Final. The vulnerability (HTTP/2 content-length validation bypass when endStream=true) was fixed by upstream commit b0fa4d5aab in March 2021 as part of Netty 4.1.61.Final. Since the target version is 4.1.101.Final (released later), the fix was already present in the upstream release when TuxCare onboarded it in October 2026. The fix (isTra..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.101.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.101.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.101.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T13:36:00.176667+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.101.Final-tuxcare.2 of io.netty:netty-codec-http2."
    }
  ]
}