{
  "@id": "urn:uuid:7710b275-c2a7-40b0-9cba-6116268793a5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T07:51:59.701187+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:51:59.701187+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.38.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.38.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:06:00.167611+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2. CVE-2026-42587 describes a vulnerability where the maxAllocation parameter (introduced to prevent decompression bomb attacks) is silently ignored for Brotli, Zstd, and Snappy encodings, allowing attackers to bypass the configured memory limit. Version 4.1.38.Final is NOT AFFECTED because the maxAllocation feature does not exist in this version at all. The vulnerable code pattern (incomplete maxAllocation enforcement for non-gzip encodings) cannot exist when maxAllocation itself was not introduced until May 2025 (commit a155024263), well after the 4.1.38.Final release. This version only supports gzip/deflate decompression with no configurable memory limits. The attack chain is broken at the \"configured limit\" step - there is no configured limit to bypass.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "CVE-2026-42587 describes a vulnerability where the maxAllocation parameter (introduced to prevent decompression bomb attacks) is silently ignored for Brotli, Zstd, and Snappy encodings, allowing attackers to bypass the configured memory limit. Version 4.1.38.Final is NOT AFFECTED because the maxAllocation feature does not exist in this version at all. The vulnerable code pattern (incomplete maxAllocation enforcement for non-gzip encodings) cannot exist when maxAllocation itself was not introduced until May 2025 (commit a155024263), well after the 4.1.38.Final release. This version only supports gzip/deflate decompression with no configurable memory limits. The attack chain is broken at the \"configured limit\" step - there is no configured limit to bypass."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:51:59.701187+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.38.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      },
      "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.38.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:51:59.701187+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.38.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2, and is fixed in 4.1.38.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-codec-http2."
    }
  ]
}