{
  "@id": "urn:uuid:b33f586e-e293-4410-8ed6-93ffda6db42d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:30:18.916796+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:24:00.135693+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 fix is already present in netty 4.1.117.Final. The vulnerability concerned HTTP/2 to HTTP/1.1 request smuggling due to missing Content-Length validation. The fix (commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 by Norman Maurer) was included in upstream netty 4.1.60.Final and is present in the 4.1.117.Final release that TuxCare onboarded. The target contains all fix components: H...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 fix is already present in netty 4.1.117.Final. The vulnerability concerned HTTP/2 to HTTP/1.1 request smuggling due to missing Content-Length validation. The fix (commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 by Norman Maurer) was included in upstream netty 4.1.60.Final and is present in the 4.1.117.Final release that TuxCare onboarded. The target contains all fix components: H..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:30:18.916796+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409: The target repository (Netty 4.1.117.Final) is not affected because the vulnerability was fixed in upstream release 4.1.61.Final and this fix is present in the target version. The fix adds proper content-length validation for single HTTP/2 HEADERS frames with endStream=true by computing the isTrailers state before validation, preventing request smuggling attacks when proxying to...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409: The target repository (Netty 4.1.117.Final) is not affected because the vulnerability was fixed in upstream release 4.1.61.Final and this fix is present in the target version. The fix adds proper content-length validation for single HTTP/2 HEADERS frames with endStream=true by computing the isTrailers state before validation, preventing request smuggling attacks when proxying to..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      },
      "action_statement": "Vulnerability CVE-2025-55163 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2, and is fixed in 4.1.117.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.117.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.117.Final-tuxcare.2 of io.netty:netty-codec-http2."
    }
  ]
}