{
  "@id": "urn:uuid:38aa273a-20b9-4548-b2e4-4c4367497f82",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T14:09:00.038715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 is not present in the target. The upstream vendor fix was already included in Netty 4.1.60.Final (March 2021) and is present in the target version 4.1.87.Final. The fix validates Content-Length headers during HTTP/2 processing and verifies that the sum of data frames matches the declared length, preventing request smuggling when downgrading to HTTP/1.1.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 is not present in the target. The upstream vendor fix was already included in Netty 4.1.60.Final (March 2021) and is present in the target version 4.1.87.Final. The fix validates Content-Length headers during HTTP/2 processing and verifies that the sum of data frames matches the declared length, preventing request smuggling when downgrading to HTTP/1.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21409 is not present in Netty 4.1.87.Final. The vulnerability, which allowed bypassing content-length validation in HTTP/2 single HEADERS frames with endStream=true (leading to request smuggling), was fixed in upstream Netty 4.1.61.Final by commit b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432. Since 4.1.87.Final > 4.1.61.Final, the fix was already included in the upstream release that TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21409 is not present in Netty 4.1.87.Final. The vulnerability, which allowed bypassing content-length validation in HTTP/2 single HEADERS frames with endStream=true (leading to request smuggling), was fixed in upstream Netty 4.1.61.Final by commit b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432. Since 4.1.87.Final > 4.1.61.Final, the fix was already included in the upstream release that TuxCa..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 is fixed in version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2. not_affected \u2014 Netty 4.1.87.Final is not affected by CVE-2026-48043. The vulnerability exists in a newer architectural pattern (4.1.135.Final-SNAPSHOT, June 2026) that uses an anonymous ChannelInboundHandlerAdapter in the EmbeddedChannel pipeline without try-finally protection around buf.release(). This code path does not exist in 4.1.87.Final (January 2023). The target version uses a simpler architecture whe...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.87.Final is not affected by CVE-2026-48043. The vulnerability exists in a newer architectural pattern (4.1.135.Final-SNAPSHOT, June 2026) that uses an anonymous ChannelInboundHandlerAdapter in the EmbeddedChannel pipeline without try-finally protection around buf.release(). This code path does not exist in 4.1.87.Final (January 2023). The target version uses a simpler architecture whe..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.87.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:45.850126+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.87.Final-tuxcare.4 of io.netty:netty-codec-http2."
    }
  ]
}