{
  "@id": "urn:uuid:1a0ebf4e-c98c-431a-8928-6bbd942c4ad4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T08:09:00.106872+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 is fixed in version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21295"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:08:20.959393+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 is fixed in version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2021-21409"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2. Target version Netty 4.1.39.Final is not affected by CVE-2026-42587. This version predates the vulnerable features: it does not support Brotli, Zstd, or Snappy compression for HTTP content encoding, and does not have the maxAllocation parameter. The vulnerability requires both alternative compression codec support AND the maxAllocation bypass behavior - neither exist in this version. HttpContentDecompressor and DelegatingDecompressorFrameListener only handle GZIP and DEFLATE encodings, returning null for any unsupported encoding including br/zstd/snappy.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "impact_statement": "Target version Netty 4.1.39.Final is not affected by CVE-2026-42587. This version predates the vulnerable features: it does not support Brotli, Zstd, or Snappy compression for HTTP content encoding, and does not have the maxAllocation parameter. The vulnerability requires both alternative compression codec support AND the maxAllocation bypass behavior - neither exist in this version. HttpContentDecompressor and DelegatingDecompressorFrameListener only handle GZIP and DEFLATE encodings, returning null for any unsupported encoding including br/zstd/snappy."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:08:20.959393+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:09:00.106872+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.39.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:36.985184+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.39.Final-tuxcare.2 of io.netty:netty-codec-http2."
    }
  ]
}