{
  "@id": "urn:uuid:7613925e-2260-4800-b938-5a2f2a1b7f62",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:27:41.190587+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:21:00.086867+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 The target (Netty 4.1.119.Final-tuxcare.3) is NOT affected by CVE-2021-21295. The upstream fix for this HTTP/2-to-HTTP/1.1 request smuggling vulnerability was introduced in Netty 4.1.60.Final (commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 by Norman Maurer). Since the target version 4.1.119.Final is 59 releases later than the fixed version, the complete defense is already present in the upstre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 The target (Netty 4.1.119.Final-tuxcare.3) is NOT affected by CVE-2021-21295. The upstream fix for this HTTP/2-to-HTTP/1.1 request smuggling vulnerability was introduced in Netty 4.1.60.Final (commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 by Norman Maurer). Since the target version 4.1.119.Final is 59 releases later than the fixed version, the complete defense is already present in the upstre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:27:41.190587+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is NOT present in the target. The vulnerability involved HTTP/2 content-length validation bypass when a single HEADERS frame with endStream=true was received. The fix (commit b0fa4d5aab) was authored by upstream Netty maintainer Norman Maurer and shipped in Netty 4.1.61.Final. The target version 4.1.119.Final inherited this fix from upstream before TuxCare onboarding. The fix cod...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is NOT present in the target. The vulnerability involved HTTP/2 content-length validation bypass when a single HEADERS frame with endStream=true was received. The fix (commit b0fa4d5aab) was authored by upstream Netty maintainer Norman Maurer and shipped in Netty 4.1.61.Final. The target version 4.1.119.Final inherited this fix from upstream before TuxCare onboarding. The fix cod..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.119.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.119.Final-tuxcare.2 of io.netty:netty-codec-http2."
    }
  ]
}