{
  "@id": "urn:uuid:9ffa616e-3e90-4b81-b350-7386e1548403",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T22:14:00.093208+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 The target repository (Netty 4.1.76.Final) is NOT affected by CVE-2021-21295. The vulnerability was patched in upstream Netty 4.1.60.Final, and since 4.1.76.Final > 4.1.60.Final, the fix was already present in the upstream release that TuxCare onboarded. The fix adds Content-Length validation in DefaultHttp2ConnectionDecoder that prevents HTTP/2 to HTTP/1.1 request smuggling by ensuring receive...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.76.Final) is NOT affected by CVE-2021-21295. The vulnerability was patched in upstream Netty 4.1.60.Final, and since 4.1.76.Final > 4.1.60.Final, the fix was already present in the upstream release that TuxCare onboarded. The fix adds Content-Length validation in DefaultHttp2ConnectionDecoder that prevents HTTP/2 to HTTP/1.1 request smuggling by ensuring receive..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in target version 4.1.76.Final. The vulnerability involved missing content-length validation when HTTP/2 HEADERS frames with endStream=true were processed, potentially leading to request smuggling. The fix (commit b0fa4d5aab by Norman Maurer) was included in upstream Netty 4.1.61.Final. Since the target is version 4.1.76.Final, which is after 4.1.61.Final, the fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in target version 4.1.76.Final. The vulnerability involved missing content-length validation when HTTP/2 HEADERS frames with endStream=true were processed, potentially leading to request smuggling. The fix (commit b0fa4d5aab by Norman Maurer) was included in upstream Netty 4.1.61.Final. Since the target is version 4.1.76.Final, which is after 4.1.61.Final, the fix ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      },
      "action_statement": "Vulnerability CVE-2025-55163 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:14:00.093208+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 Version 4.1.76.Final is not affected by CVE-2026-48043. The target uses a different architecture than the vulnerable versions: it processes HTTP/2 decompression directly in the onDataRead method (lines 76-144) with try-finally protection (lines 106-137) that ensures pooled ByteBuf is released even when flow-controller operations throw exceptions. The vulnerable pattern\u2014an anonymous ChannelInbou...",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.76.Final is not affected by CVE-2026-48043. The target uses a different architecture than the vulnerable versions: it processes HTTP/2 decompression directly in the onDataRead method (lines 76-144) with try-finally protection (lines 106-137) that ensures pooled ByteBuf is released even when flow-controller operations throw exceptions. The vulnerable pattern\u2014an anonymous ChannelInbou..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      },
      "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.76.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T22:13:21.712110+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.76.Final-tuxcare.2 of io.netty:netty-codec-http2."
    }
  ]
}