{
  "@id": "urn:uuid:a67a4d49-0f07-4b9e-8f2b-dcc32b6459b5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T09:43:00.043308+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:25:00.378854+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 CVE-2021-21295 is not present in target Netty 4.1.99.Final-tuxcare.2. The vulnerability (unvalidated Content-Length header enabling HTTP/2\u2192HTTP/1.1 request smuggling) was fixed in upstream Netty 4.1.60.Final via commit 89c241e3b1. The fix shipped with upstream 4.1.99.Final before TuxCare onboarded it. Defense present: HttpUtil.normalizeAndGetContentLength() validates header syntax (rejects nega...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 is not present in target Netty 4.1.99.Final-tuxcare.2. The vulnerability (unvalidated Content-Length header enabling HTTP/2\u2192HTTP/1.1 request smuggling) was fixed in upstream Netty 4.1.60.Final via commit 89c241e3b1. The fix shipped with upstream 4.1.99.Final before TuxCare onboarded it. Defense present: HttpUtil.normalizeAndGetContentLength() validates header syntax (rejects nega..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:30:18.916796+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 The target Netty 4.1.99.Final is NOT affected by CVE-2021-21409. The vulnerability involved bypassed content-length validation when a single HTTP/2 HEADERS frame with endStream=true was received, potentially enabling request smuggling. However, the upstream fix (commit b0fa4d5aab) was already included in the Netty 4.1.99.Final release before TuxCare onboarded it. The fix is present in DefaultHt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 The target Netty 4.1.99.Final is NOT affected by CVE-2021-21409. The vulnerability involved bypassed content-length validation when a single HTTP/2 HEADERS frame with endStream=true was received, potentially enabling request smuggling. However, the upstream fix (commit b0fa4d5aab) was already included in the Netty 4.1.99.Final release before TuxCare onboarded it. The fix is present in DefaultHt..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2025-55163"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-33871"
      },
      "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability CVE-2026-42587 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-42587"
      },
      "action_statement": "Vulnerability CVE-2026-42587 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability CVE-2026-47244 is fixed in version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-47244"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2. not_affected \u2014 Target version 4.1.99.Final is not affected by CVE-2026-48043. The vulnerable pattern (missing finally block around buf.release() in decompression handling) was never present in this version. The upstream Netty project added the finally block protection in June 2016 (commit 6aa5f76d42 by Scott Mitchell), years before 4.1.99.Final was released (September 2023). The CVE describes a vulnerability ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48043"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.99.Final is not affected by CVE-2026-48043. The vulnerable pattern (missing finally block around buf.release() in decompression handling) was never present in this version. The upstream Netty project added the finally block protection in June 2016 (commit 6aa5f76d42 by Scott Mitchell), years before 4.1.99.Final was released (September 2023). The CVE describes a vulnerability ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability CVE-2026-50560 is fixed in version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-50560"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability CVE-2026-56819 is fixed in version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-56819"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "CVE-2026-59900"
      },
      "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-codec-http2@4.1.99.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T17:15:36.741360+00:00",
      "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2.",
      "vulnerability": {
        "name": "GHSA-xpw8-rcwv-8f8p"
      },
      "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.99.Final-tuxcare.2 of io.netty:netty-codec-http2."
    }
  ]
}