{
  "@id": "urn:uuid:2abe302b-683b-47f8-a1a5-ad7d4179ca49",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T09:13:20.704692+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 (HTTP/2 request smuggling via unvalidated Content-Length) is NOT present in target version 4.1.74.Final. The fix was shipped in upstream Netty 4.1.60.Final and is included in the 4.1.74.Final release. The target contains complete content-length validation: HttpUtil.normalizeAndGetContentLength() validates header format (rejects empty, negative, non-numeric values, handles duplica...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 (HTTP/2 request smuggling via unvalidated Content-Length) is NOT present in target version 4.1.74.Final. The fix was shipped in upstream Netty 4.1.60.Final and is included in the 4.1.74.Final release. The target contains complete content-length validation: HttpUtil.normalizeAndGetContentLength() validates header format (rejects empty, negative, non-numeric values, handles duplica..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 The target repository (Netty 4.1.74.Final-tuxcare.1) is NOT AFFECTED by CVE-2021-21409. The vulnerability was fixed in upstream Netty 4.1.61.Final (March 2021), and since the target version 4.1.74.Final was released after that fix, the vulnerable code pattern is not present. Git analysis confirms the fix commit (b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432 by Norman Maurer) is an ancestor of the Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.74.Final-tuxcare.1) is NOT AFFECTED by CVE-2021-21409. The vulnerability was fixed in upstream Netty 4.1.61.Final (March 2021), and since the target version 4.1.74.Final was released after that fix, the vulnerable code pattern is not present. Git analysis confirms the fix commit (b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432 by Norman Maurer) is an ancestor of the Tu..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2. not_affected \u2014 Version 4.1.74.Final is not affected by CVE-2026-48043. The vulnerability exists only in a NEW architecture introduced by CVE-2026-42587 (anonymous ChannelInboundHandlerAdapter with unprotected buf.release()). CVE-2026-42587 was backported to versions 4.1.79+, but NOT to 4.1.74.Final. The 4.1.74.Final codebase retains the OLD architecture (for-loop with try-finally) that already includes proper...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.74.Final is not affected by CVE-2026-48043. The vulnerability exists only in a NEW architecture introduced by CVE-2026-42587 (anonymous ChannelInboundHandlerAdapter with unprotected buf.release()). CVE-2026-42587 was backported to versions 4.1.79+, but NOT to 4.1.74.Final. The 4.1.74.Final codebase retains the OLD architecture (for-loop with try-finally) that already includes proper..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-codec-http2."
    }
  ]
}