{
  "@id": "urn:uuid:5056a037-afb1-429e-9f0a-3052bd08c97e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:29:00.121332+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:21:00.086867+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 Target repository Netty 4.1.111.Final-tuxcare.2 is not affected by CVE-2021-21295. The vulnerability was fixed in upstream Netty 4.1.60.Final (March 2021) by commit 89c241e3b1 authored by norman_maurer@apple.com. The target version 4.1.111.Final, onboarded by TuxCare in 2024, includes this fix as part of its upstream code base. The fix validates Content-Length headers in HTTP/2 requests and ver...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 Target repository Netty 4.1.111.Final-tuxcare.2 is not affected by CVE-2021-21295. The vulnerability was fixed in upstream Netty 4.1.60.Final (March 2021) by commit 89c241e3b1 authored by norman_maurer@apple.com. The target version 4.1.111.Final, onboarded by TuxCare in 2024, includes this fix as part of its upstream code base. The fix validates Content-Length headers in HTTP/2 requests and ver..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:29:00.121332+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in netty 4.1.111.Final-tuxcare.2. The vulnerability affected HTTP/2 content-length header validation when a single HEADERS frame with endStream=true was received, potentially enabling HTTP request smuggling. The upstream fix (commit b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432 by Norman Maurer) was released in Netty 4.1.61.Final and is present in this version. The fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in netty 4.1.111.Final-tuxcare.2. The vulnerability affected HTTP/2 content-length header validation when a single HEADERS frame with endStream=true was received, potentially enabling HTTP request smuggling. The upstream fix (commit b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432 by Norman Maurer) was released in Netty 4.1.61.Final and is present in this version. The fix ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.111.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.111.Final-tuxcare.1 of io.netty:netty-codec-http2."
    }
  ]
}