{ "@id": "urn:uuid:d805be79-f7ea-425a-be24-781033369454", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T14:20:31.400215+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2019-20444 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. CVE-2019-20444 is not present in Netty 4.2.12.Final. The vulnerability (missing colon validation in HTTP header parsing) was fixed in upstream Netty before the 4.2.12.Final release. The fix (lines 1136-1139 in HttpObjectDecoder.java) rejects headers without colons by throwing IllegalArgumentException. This fix was included when TuxCare onboarded the upstream 4.2.12.Final release on 2026-09-12, authored by upstream Netty maintainer Norman Maurer.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20444" }, "impact_statement": "CVE-2019-20444 is not present in Netty 4.2.12.Final. The vulnerability (missing colon validation in HTTP header parsing) was fixed in upstream Netty before the 4.2.12.Final release. The fix (lines 1136-1139 in HttpObjectDecoder.java) rejects headers without colons by throwing IllegalArgumentException. This fix was included when TuxCare onboarded the upstream 4.2.12.Final release on 2026-09-12, authored by upstream Netty maintainer Norman Maurer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2021-21290 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2021-21290 is NOT affecting target version 4.2.12.Final. The vulnerability concerns insecure temporary file creation using File.createTempFile() which creates world-readable files (-rw-r--r--) on unix-like systems, allowing local information disclosure. The target contains the complete upstream fix: PlatformDependent.createTempFile() (lines 1747-1752) uses the secure Files.createTempFile() ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21290" }, "impact_statement": "not_affected \u2014 CVE-2021-21290 is NOT affecting target version 4.2.12.Final. The vulnerability concerns insecure temporary file creation using File.createTempFile() which creates world-readable files (-rw-r--r--) on unix-like systems, allowing local information disclosure. The target contains the complete upstream fix: PlatformDependent.createTempFile() (lines 1747-1752) uses the secure Files.createTempFile() ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2021-43797 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target version 4.2.12.Final is NOT affected by CVE-2021-43797. The vulnerability fix was already present in the upstream Netty 4.2.12.Final release that TuxCare onboarded. Both components of the fix are present: (1) HttpObjectDecoder.findNonWhitespace() validates that only OWS (space 0x20 or tab 0x09) is allowed before/after header names and throws IllegalArgumentException for other whitesp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43797" }, "impact_statement": "not_affected \u2014 The target version 4.2.12.Final is NOT affected by CVE-2021-43797. The vulnerability fix was already present in the upstream Netty 4.2.12.Final release that TuxCare onboarded. Both components of the fix are present: (1) HttpObjectDecoder.findNonWhitespace() validates that only OWS (space 0x20 or tab 0x09) is allowed before/after header names and throws IllegalArgumentException for other whitesp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2022-24823 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 The target Netty 4.2.12.Final is NOT AFFECTED by CVE-2022-24823. The vulnerability required Java 6 support where File.createTempFile() created world-readable temporary files. The target version removed all Java 6/7 compatibility code and exclusively uses Files.createTempFile() (Java 7+ NIO API), which creates files with owner-only permissions by default. The vulnerable code path does not exist ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24823" }, "impact_statement": "not_affected \u2014 The target Netty 4.2.12.Final is NOT AFFECTED by CVE-2022-24823. The vulnerability required Java 6 support where File.createTempFile() created world-readable temporary files. The target version removed all Java 6/7 compatibility code and exclusively uses Files.createTempFile() (Java 7+ NIO API), which creates files with owner-only permissions by default. The vulnerable code path does not exist ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2022-41915 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2022-41915 is not present in this target. The vulnerability (missing validation in setObject methods with iterator/array parameters) was fixed by upstream commit fe18adff1c, authored by Chris Vest (christianvest_hansen@apple.com). This fix was already included in the upstream release 4.2.12.Final before TuxCare onboarded it (first TuxCare commit: 90601c734385170fd69ab3f5e529ef179563e0b9). T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41915" }, "impact_statement": "not_affected \u2014 CVE-2022-41915 is not present in this target. The vulnerability (missing validation in setObject methods with iterator/array parameters) was fixed by upstream commit fe18adff1c, authored by Chris Vest (christianvest_hansen@apple.com). This fix was already included in the upstream release 4.2.12.Final before TuxCare onboarded it (first TuxCare commit: 90601c734385170fd69ab3f5e529ef179563e0b9). T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2024-29025 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.2.12.Final is not affected by CVE-2024-29025. The vulnerability allowed unbounded memory accumulation through unlimited form fields or buffered bytes in HttpPostRequestDecoder. The fix (upstream commit 0d0c6ed782) adds maxFields (default 128) and maxBufferedBytes (default 1024) limits with enforcement checks that throw TooManyFormFieldsException and TooLongFormFieldException. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-29025" }, "impact_statement": "not_affected \u2014 Target version 4.2.12.Final is not affected by CVE-2024-29025. The vulnerability allowed unbounded memory accumulation through unlimited form fields or buffered bytes in HttpPostRequestDecoder. The fix (upstream commit 0d0c6ed782) adds maxFields (default 128) and maxBufferedBytes (default 1024) limits with enforcement checks that throw TooManyFormFieldsException and TooLongFormFieldException. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2025-58056 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 Target version 4.2.12.Final is not affected by CVE-2025-58056. The upstream fix for HTTP/1.1 chunked encoding request smuggling was merged on 2025-09-03 (commit edb55fd8e0a), 6+ months before the upstream 4.2.12.Final release (2026-03-25). TuxCare onboarded an already-fixed version on 2026-09-12. The fix includes strict CRLF validation in chunk extensions (throws InvalidChunkExtensionException ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58056" }, "impact_statement": "not_affected \u2014 Target version 4.2.12.Final is not affected by CVE-2025-58056. The upstream fix for HTTP/1.1 chunked encoding request smuggling was merged on 2025-09-03 (commit edb55fd8e0a), 6+ months before the upstream 4.2.12.Final release (2026-03-25). TuxCare onboarded an already-fixed version on 2026-09-12. The fix includes strict CRLF validation in chunk extensions (throws InvalidChunkExtensionException ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2025-67735 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. not_affected \u2014 CVE-2025-67735 (CRLF injection in HttpRequestEncoder leading to request smuggling) is NOT present in target Netty 4.2.12.Final. The upstream vendor fix was already included in the Netty 4.2.12.Final release that TuxCare onboarded. The fix adds validation in DefaultHttpRequest constructor that rejects URIs containing CRLF (\\r, \\n) or space characters by throwing IllegalArgumentException, prevent...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-67735" }, "impact_statement": "not_affected \u2014 CVE-2025-67735 (CRLF injection in HttpRequestEncoder leading to request smuggling) is NOT present in target Netty 4.2.12.Final. The upstream vendor fix was already included in the Netty 4.2.12.Final release that TuxCare onboarded. The fix adds validation in DefaultHttpRequest constructor that rejects URIs containing CRLF (\\r, \\n) or space characters by throwing IllegalArgumentException, prevent..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-33870 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http. The target Netty 4.2.12.Final is NOT AFFECTED by CVE-2026-33870. The vulnerability fix was already present in the upstream 4.2.12.Final release that TuxCare onboarded. The fix includes HttpChunkLineValidatingByteProcessor (a state machine validator) and checkChunkExtensions() method in HttpObjectDecoder that rejects chunk extensions containing CR/LF bytes before the line-terminating CRLF, preventing request smuggling attacks. Fix commit 3b76df185678353733aa21702d6be16130d188a0 by christianvest_hansen@apple.com was authored upstream and shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), NVD (< 4.1.132; >= 4.2.0, < 4.2.10), cve.org (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), Snyk (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.12.Final; < 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.12.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33870" }, "impact_statement": "The target Netty 4.2.12.Final is NOT AFFECTED by CVE-2026-33870. The vulnerability fix was already present in the upstream 4.2.12.Final release that TuxCare onboarded. The fix includes HttpChunkLineValidatingByteProcessor (a state machine validator) and checkChunkExtensions() method in HttpObjectDecoder that rejects chunk extensions containing CR/LF bytes before the line-terminating CRLF, preventing request smuggling attacks. Fix commit 3b76df185678353733aa21702d6be16130d188a0 by christianvest_hansen@apple.com was authored upstream and shipped with the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), NVD (< 4.1.132; >= 4.2.0, < 4.2.10), cve.org (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final), Snyk (< 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.12.Final; < 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.12.Final)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-41417 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-41417" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:31.400215+00:00", "status_notes": "Vulnerability CVE-2026-42580 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42580" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:28.122582+00:00", "status_notes": "Vulnerability CVE-2026-42581 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42581" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-42584 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42584" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-42587 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-42587" }, "action_statement": "Vulnerability CVE-2026-42587 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:31.400215+00:00", "status_notes": "Vulnerability CVE-2026-50020 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-50020" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:31.400215+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-http@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-codec-http." } ] }