{
  "@id": "urn:uuid:107fb276-3fca-4d69-81bc-c26ebc4d3c1a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 22,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:26:00.163611+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:21:00.086867+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 (HTTP/2 Content-Length validation bypass enabling request smuggling) is NOT present in Netty 4.1.114.Final-tuxcare.2. The target contains the complete upstream fix by Norman Maurer (commit 89c241e3b1, March 2021) that validates Content-Length headers and verifies data matches declared length. This fix shipped in the upstream release before TuxCare onboarded version 4.1.114.Final....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 (HTTP/2 Content-Length validation bypass enabling request smuggling) is NOT present in Netty 4.1.114.Final-tuxcare.2. The target contains the complete upstream fix by Norman Maurer (commit 89c241e3b1, March 2021) that validates Content-Length headers and verifies data matches declared length. This fix shipped in the upstream release before TuxCare onboarded version 4.1.114.Final...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:26:00.163611+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in Netty 4.1.114.Final. The vulnerability was fixed in upstream Netty 4.1.61.Final (March 2021) by Norman Maurer, long before TuxCare onboarded version 4.1.114.Final. The fix introduces an isTrailers boolean that captures the header type before stream state changes, ensuring content-length validation occurs even when endStream=true on initial headers. This fix was ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in Netty 4.1.114.Final. The vulnerability was fixed in upstream Netty 4.1.61.Final (March 2021) by Norman Maurer, long before TuxCare onboarded version 4.1.114.Final. The fix introduces an isTrailers boolean that captures the header type before stream state changes, ensuring content-length validation occurs even when endStream=true on initial headers. This fix was ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2026-48043 affects a ChannelInboundHandlerAdapter code path introduced by CVE-2026-42587. Version 4.1.114.Final never received the CVE-2026-42587 backport, so the vulnerable code structure does not exist in this version. The vulnerability cannot manifest because the affected code path was never added.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-48043 affects a ChannelInboundHandlerAdapter code path introduced by CVE-2026-42587. Version 4.1.114.Final never received the CVE-2026-42587 backport, so the vulnerable code structure does not exist in this version. The vulnerability cannot manifest because the affected code path was never added."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-codec-http2."
    }
  ]
}