{
  "@id": "urn:uuid:af4e8e10-f66a-4c4a-a758-f72011957ac7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:06:44.318506+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2014-0193 affects version 3.7.0.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2014-0193"
      },
      "action_statement": "Vulnerability CVE-2014-0193 affects version 3.7.0.Final-tuxcare.2 of io.netty:netty."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2015-2156 affects version 3.7.0.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2015-2156"
      },
      "action_statement": "Vulnerability CVE-2015-2156 affects version 3.7.0.Final-tuxcare.2 of io.netty:netty."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2019-16869 is fixed in version 3.7.0.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2019-16869"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 3.7.0.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2019-20444"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 3.7.0.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 3.7.0.Final-tuxcare.2 of io.netty:netty."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 3.7.0.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2021-21290"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2021-21295 does not affect version 3.7.0.Final-tuxcare.2 of io.netty:netty. not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2021-21295. This vulnerability concerns HTTP/2 Content-Length validation in Netty 4.x's HTTP/2 codec. Netty 3.x (package org.jboss.netty) has no HTTP/2 support - it only supports HTTP/1.0 and HTTP/1.1. The vulnerable component (HTTP/2 codec) was introduced in Netty 4.x and does not exist in Netty 3.x at all.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21295"
      },
      "impact_statement": "not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2021-21295. This vulnerability concerns HTTP/2 Content-Length validation in Netty 4.x's HTTP/2 codec. Netty 3.x (package org.jboss.netty) has no HTTP/2 support - it only supports HTTP/1.0 and HTTP/1.1. The vulnerable component (HTTP/2 codec) was introduced in Netty 4.x and does not exist in Netty 3.x at all."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2021-21409 does not affect version 3.7.0.Final-tuxcare.2 of io.netty:netty. not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2021-21409. This CVE concerns improper HTTP/2 content-length validation in Netty 4.x's codec-http2 module. Netty 3.7.0.Final predates HTTP/2 support entirely - it uses the legacy org.jboss.netty.* package namespace and only supports HTTP/1.x, SPDY, and other pre-HTTP/2 protocols. The vulnerable code (DefaultHttp2ConnectionDecoder) and HTTP/2 frame types ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-21409"
      },
      "impact_statement": "not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2021-21409. This CVE concerns improper HTTP/2 content-length validation in Netty 4.x's codec-http2 module. Netty 3.7.0.Final predates HTTP/2 support entirely - it uses the legacy org.jboss.netty.* package namespace and only supports HTTP/1.x, SPDY, and other pre-HTTP/2 protocols. The vulnerable code (DefaultHttp2ConnectionDecoder) and HTTP/2 frame types ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 does not affect version 3.7.0.Final-tuxcare.2 of io.netty:netty. Target version netty-3.7.0.Final (package org.jboss.netty) does not contain the Bzip2Decoder component affected by CVE-2021-37136. The Bzip2 compression codec was introduced in Netty 4.x (package io.netty) and never existed in the Netty 3.x codebase. The target only implements Zlib-based compression; a TODO comment in package-info.java (line 28) confirms Bzip2 was planned but never implemented in this version. All CVE-2021-37136 backports in the repository history apply exclusively to 4.1.x versions (4.1.43, 4.1.48, 4.1.52, 4.1.58, 4.1.60, 4.1.63). Exhaustive searches found zero Bzip2 references, no vendored Bzip2 libraries, and no dependencies providing Bzip2 decompression. Verdict: NOT_AFFECTED per Rule 5 Type A1 (input type not received anywhere in codebase).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "impact_statement": "Target version netty-3.7.0.Final (package org.jboss.netty) does not contain the Bzip2Decoder component affected by CVE-2021-37136. The Bzip2 compression codec was introduced in Netty 4.x (package io.netty) and never existed in the Netty 3.x codebase. The target only implements Zlib-based compression; a TODO comment in package-info.java (line 28) confirms Bzip2 was planned but never implemented in this version. All CVE-2021-37136 backports in the repository history apply exclusively to 4.1.x versions (4.1.43, 4.1.48, 4.1.52, 4.1.58, 4.1.60, 4.1.63). Exhaustive searches found zero Bzip2 references, no vendored Bzip2 libraries, and no dependencies providing Bzip2 decompression. Verdict: NOT_AFFECTED per Rule 5 Type A1 (input type not received anywhere in codebase)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 does not affect version 3.7.0.Final-tuxcare.2 of io.netty:netty. Netty 3.7.0.Final is not affected by CVE-2021-37137. The vulnerability concerns SnappyFrameDecoder, which was introduced in Netty 4.0.0.Beta1 and never existed in the 3.x lineage. Version 3.7.0.Final (released Sept 2013) predates the Netty 4.x rewrite where Snappy compression support was added (Dec 2012, first released in 4.0.0.Beta1). The target has no code that receives or processes Snappy-framed data.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "impact_statement": "Netty 3.7.0.Final is not affected by CVE-2021-37137. The vulnerability concerns SnappyFrameDecoder, which was introduced in Netty 4.0.0.Beta1 and never existed in the 3.x lineage. Version 3.7.0.Final (released Sept 2013) predates the Netty 4.x rewrite where Snappy compression support was added (Dec 2012, first released in 4.0.0.Beta1). The target has no code that receives or processes Snappy-framed data."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2021-43797 is fixed in version 3.7.0.Final-tuxcare.2 of io.netty:netty.",
      "vulnerability": {
        "name": "CVE-2021-43797"
      }
    }
  ]
}