{
  "@id": "urn:uuid:fcd46c74-911d-417d-8354-9cdabea73bc0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:06:44.318506+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:25.427202+00:00",
      "status_notes": "Vulnerability CVE-2014-0193 affects version 3.6.2.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2014-0193"
      },
      "action_statement": "Vulnerability CVE-2014-0193 affects version 3.6.2.Final-tuxcare.2 of io.netty:netty."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:25.427202+00:00",
      "status_notes": "Vulnerability CVE-2015-2156 affects version 3.6.2.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2015-2156"
      },
      "action_statement": "Vulnerability CVE-2015-2156 affects version 3.6.2.Final-tuxcare.2 of io.netty:netty."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:45.656297+00:00",
      "status_notes": "Vulnerability CVE-2019-16869 is fixed in version 3.6.2.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2019-16869"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:45.656297+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 3.6.2.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2019-20444"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:25.427202+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 3.6.2.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 3.6.2.Final-tuxcare.2 of io.netty:netty."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:25.427202+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 3.6.2.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:25.427202+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 3.6.2.Final-tuxcare.2 of io.netty:netty. not_affected \u2014 CVE-2021-21295 affects HTTP/2\u2192HTTP/1.1 request smuggling via Content-Length validation bypass. Netty 3.6.2.Final does not have HTTP/2 support - it predates HTTP/2 protocol adoption and only supports HTTP/1.x. The vulnerable components (Http2MultiplexCodec, Http2FrameCodec, Http2StreamFrameToHttpObjectCodec, and the entire codec-http2 module) do not exist in this version. HTTP/2 support was intr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-21295 affects HTTP/2\u2192HTTP/1.1 request smuggling via Content-Length validation bypass. Netty 3.6.2.Final does not have HTTP/2 support - it predates HTTP/2 protocol adoption and only supports HTTP/1.x. The vulnerable components (Http2MultiplexCodec, Http2FrameCodec, Http2StreamFrameToHttpObjectCodec, and the entire codec-http2 module) do not exist in this version. HTTP/2 support was intr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:25.427202+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 3.6.2.Final-tuxcare.2 of io.netty:netty. not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2021-21409. This CVE concerns HTTP/2 content-length header validation in the codec-http2 module's DefaultHttp2ConnectionDecoder class when a single HEADERS frame with endStream=true is received. Netty 3.x does not have HTTP/2 support - HTTP/2 was only added in Netty 4.1.x. The target repository contains only HTTP/1.x codec (org.jboss.netty.handler.codec....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2021-21409. This CVE concerns HTTP/2 content-length header validation in the codec-http2 module's DefaultHttp2ConnectionDecoder class when a single HEADERS frame with endStream=true is received. Netty 3.x does not have HTTP/2 support - HTTP/2 was only added in Netty 4.1.x. The target repository contains only HTTP/1.x codec (org.jboss.netty.handler.codec...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:25.427202+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 does not affect version 3.6.2.Final-tuxcare.2 of io.netty:netty. Netty 3.6.2.Final does not contain Bzip2 decompression functionality. CVE-2021-37136 affects Bzip2Decoder in Netty 4.x, but this version (3.x) predates Bzip2 support. The compression codec directory contains only Zlib-based decompression (ZlibDecoder for deflate/gzip). A TODO comment in package-info.java explicitly states \"TODO Implement bzip2 and lzma handlers\", confirming Bzip2 was planned but never implemented in the 3.x branch. Exhaustive searches found zero Bzip2-related code, classes, or dependencies. The vulnerability pattern cannot exist because the affected component (Bzip2Decoder and related classes) is entirely absent from this codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "impact_statement": "Netty 3.6.2.Final does not contain Bzip2 decompression functionality. CVE-2021-37136 affects Bzip2Decoder in Netty 4.x, but this version (3.x) predates Bzip2 support. The compression codec directory contains only Zlib-based decompression (ZlibDecoder for deflate/gzip). A TODO comment in package-info.java explicitly states \"TODO Implement bzip2 and lzma handlers\", confirming Bzip2 was planned but never implemented in the 3.x branch. Exhaustive searches found zero Bzip2-related code, classes, or dependencies. The vulnerability pattern cannot exist because the affected component (Bzip2Decoder and related classes) is entirely absent from this codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:25.427202+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 does not affect version 3.6.2.Final-tuxcare.2 of io.netty:netty. Netty 3.6.2.Final is NOT AFFECTED by CVE-2021-37137. The vulnerable SnappyFrameDecoder class does not exist in this version. Snappy compression support was introduced in Netty 4.0.0.Beta1 development cycle, long after the 3.6.2.Final release. The target version only supports Zlib compression and has no capability to receive or process Snappy frame data. This satisfies Rule 5 Type A1 (input absent): the Brief's INPUT (Snappy frame data chunks) is not received anywhere in the target codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "impact_statement": "Netty 3.6.2.Final is NOT AFFECTED by CVE-2021-37137. The vulnerable SnappyFrameDecoder class does not exist in this version. Snappy compression support was introduced in Netty 4.0.0.Beta1 development cycle, long after the 3.6.2.Final release. The target version only supports Zlib compression and has no capability to receive or process Snappy frame data. This satisfies Rule 5 Type A1 (input absent): the Brief's INPUT (Snappy frame data chunks) is not received anywhere in the target codebase."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T09:49:45.656297+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 3.6.2.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      }
    }
  ]
}