{ "@id": "urn:uuid:0a35208e-c00f-45bc-a007-af0fa195c505", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T07:38:00.043306+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:38:00.043306+00:00", "status_notes": "Vulnerability CVE-2021-21295 is fixed in version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2021-21295" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability CVE-2021-21409 is fixed in version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2021-21409" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2. Version 4.1.42.Final is NOT affected by CVE-2026-42587. The vulnerability concerns BrotliDecoder, ZstdDecoder, and SnappyFrameDecoder ignoring the maxAllocation parameter for decompression bomb protection. However, these decoders and their corresponding Content-Encoding support (br, zstd, snappy) do NOT exist in this version. Both HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip and deflate encodings, returning null for unsupported encodings. The compressed input types described in the CVE are not processed by this version, so the vulnerability cannot manifest. Brotli, Zstd, and Snappy support were added in much later versions (post-4.1.42).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Version 4.1.42.Final is NOT affected by CVE-2026-42587. The vulnerability concerns BrotliDecoder, ZstdDecoder, and SnappyFrameDecoder ignoring the maxAllocation parameter for decompression bomb protection. However, these decoders and their corresponding Content-Encoding support (br, zstd, snappy) do NOT exist in this version. Both HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip and deflate encodings, returning null for unsupported encodings. The compressed input types described in the CVE are not processed by this version, so the vulnerability cannot manifest. Brotli, Zstd, and Snappy support were added in much later versions (post-4.1.42)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:20.608547+00:00", "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-50560" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-56819" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.42.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T07:37:08.625732+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.42.Final-tuxcare.4 of io.netty:netty-codec-http2." } ] }