{
  "@id": "urn:uuid:40d73305-c296-4051-b044-64e9519b4d01",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T14:09:00.038715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T17:22:46.833428+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2. not_affected \u2014 The target version 4.1.82.Final is NOT affected by CVE-2021-21295. The vulnerability (HTTP request smuggling via unvalidated Content-Length headers during HTTP/2 to HTTP/1.1 conversion) was fixed in upstream Netty 4.1.60.Final by commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 (March 2021, authored by Norman Maurer). Since 4.1.82.Final > 4.1.60.Final, the fix was already present in the upstream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 The target version 4.1.82.Final is NOT affected by CVE-2021-21295. The vulnerability (HTTP request smuggling via unvalidated Content-Length headers during HTTP/2 to HTTP/1.1 conversion) was fixed in upstream Netty 4.1.60.Final by commit 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4 (March 2021, authored by Norman Maurer). Since 4.1.82.Final > 4.1.60.Final, the fix was already present in the upstream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T17:27:00.166718+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 affects Netty HTTP/2 content-length validation when a single HEADERS frame arrives with endStream=true. The vulnerability was fixed in upstream Netty 4.1.61.Final (commit b0fa4d5aab). The target version 4.1.82.Final already contains this upstream fix, which shipped in the release that TuxCare onboarded. The vulnerable code pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 affects Netty HTTP/2 content-length validation when a single HEADERS frame arrives with endStream=true. The vulnerability was fixed in upstream Netty 4.1.61.Final (commit b0fa4d5aab). The target version 4.1.82.Final already contains this upstream fix, which shipped in the release that TuxCare onboarded. The vulnerable code pattern is not present in the target."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-01T17:52:24.426616+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2, and is fixed in 4.1.82.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      },
      "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2, and is fixed in 4.1.82.Final-tuxcare.8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 is fixed in version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-48043"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-01T17:52:24.426616+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2, and is fixed in 4.1.82.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      },
      "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2, and is fixed in 4.1.82.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.82.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p is fixed in version 4.1.82.Final-tuxcare.5 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      }
    }
  ]
}