{
  "@id": "urn:uuid:131c7e98-bc5c-4283-8cd5-512b1a6d926d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:58:17.463230+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 Target version 4.1.113.Final is NOT affected by CVE-2021-21295. The vulnerability (HTTP/2 Content-Length validation bypass leading to request smuggling) was patched in upstream Netty 4.1.60.Final via commit 89c241e3b1. The target onboarded version 4.1.113.Final which already contained this fix, so the vulnerable pattern is not present. The fix validates Content-Length headers (rejecting negativ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.113.Final is NOT affected by CVE-2021-21295. The vulnerability (HTTP/2 Content-Length validation bypass leading to request smuggling) was patched in upstream Netty 4.1.60.Final via commit 89c241e3b1. The target onboarded version 4.1.113.Final which already contained this fix, so the vulnerable pattern is not present. The fix validates Content-Length headers (rejecting negativ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T17:31:21.811364+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in the target. The vulnerability concerns HTTP/2 content-length header validation bypass when a single Http2HeaderFrame with endStream=true is received. The upstream fix (commit b0fa4d5aab by norman_maurer@apple.com) was already included in Netty version 4.1.61.Final. The target is at version 4.1.113.Final, which already contained the fix when TuxCare onboarded it ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in the target. The vulnerability concerns HTTP/2 content-length header validation bypass when a single Http2HeaderFrame with endStream=true is received. The upstream fix (commit b0fa4d5aab by norman_maurer@apple.com) was already included in Netty version 4.1.61.Final. The target is at version 4.1.113.Final, which already contained the fix when TuxCare onboarded it ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:58:17.463230+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.113.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      },
      "action_statement": "Vulnerability CVE-2025-55163 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.113.Final-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:37:26.686691+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:36:59.812668+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:37:35.866702+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:36:59.812668+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2. not_affected \u2014 Target version 4.1.113.Final is NOT AFFECTED. The vulnerable code pattern described in CVE-2026-48043 does not exist in this version. The CVE addresses a buffer leak in a ChannelInboundHandlerAdapter tail handler pattern where buf.release() was not protected by try-finally. However, 4.1.113.Final uses a different, older architecture where HTTP/2 decompression is handled directly in the onDataRe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.113.Final is NOT AFFECTED. The vulnerable code pattern described in CVE-2026-48043 does not exist in this version. The CVE addresses a buffer leak in a ChannelInboundHandlerAdapter tail handler pattern where buf.release() was not protected by try-finally. However, 4.1.113.Final uses a different, older architecture where HTTP/2 decompression is handled directly in the onDataRe..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:37:35.866702+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:36:59.812668+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:36:59.812668+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:36:59.812668+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:36:59.812668+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.113.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.113.Final-tuxcare.1 of io.netty:netty-codec-http2."
    }
  ]
}