{
  "@id": "urn:uuid:0d1b3111-7ec8-424c-ac92-8e37f3aba10d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T18:10:23.208388+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:10:23.208388+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) due to fixed-size SslBufferPool causing infinite BUFFER_OVERFLOW loops when SSLv2Hello requires >30KB buffers. Target is Netty 4.0.56.Final which uses a completely different architecture: dynamic buffer allocation via ByteBufAllocator instead of fixed-size pools. The vulnerable pattern (reusing insufficient pooled buffers) does not exist in Netty 4...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) due to fixed-size SslBufferPool causing infinite BUFFER_OVERFLOW loops when SSLv2Hello requires >30KB buffers. Target is Netty 4.0.56.Final which uses a completely different architecture: dynamic buffer allocation via ByteBufAllocator instead of fixed-size pools. The vulnerable pattern (reusing insufficient pooled buffers) does not exist in Netty 4..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 describes an infinite loop DoS in Netty's OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ with no data in the BIO buffer. The target version 4.0.56.Final contains the upstream fix (commit 524156f164) that was already present in the upstream release before TuxCare onboarding. The fix is implemented in ReferenceCountedOpenSslEngine.java (lines 748-752) where SSL_ERROR_WANT_READ now returns control to the event loop with NEED_UNWRAP status instead of continuing the loop. The vulnerable infinite loop pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 describes an infinite loop DoS in Netty's OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ with no data in the BIO buffer. The target version 4.0.56.Final contains the upstream fix (commit 524156f164) that was already present in the upstream release before TuxCare onboarding. The fix is implemented in ReferenceCountedOpenSslEngine.java (lines 748-752) where SSL_ERROR_WANT_READ now returns control to the event loop with NEED_UNWRAP status instead of continuing the loop. The vulnerable infinite loop pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 Netty version 4.0.56.Final is NOT affected by CVE-2023-34462. The vulnerability requires code to read a 3-byte handshake length field from TLS ClientHello messages and allocate/accumulate buffers based on that value (up to 16MB). Version 4.0.56.Final uses a completely different architecture: it lacks the SslClientHelloHandler class mentioned in the CVE, does not read the handshake length field,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Netty version 4.0.56.Final is NOT affected by CVE-2023-34462. The vulnerability requires code to read a 3-byte handshake length field from TLS ClientHello messages and allocate/accumulate buffers based on that value (up to 16MB). Version 4.0.56.Final uses a completely different architecture: it lacks the SslClientHelloHandler class mentioned in the CVE, does not read the handshake length field,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.0.56.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler. Version 4.0.56.Final is not affected by CVE-2026-45416. The vulnerable classes SslClientHelloHandler and AbstractSniHandler do not exist in this version - they were introduced in Netty 4.1.x. The 4.0.x SniHandler uses a fundamentally different architecture that parses ClientHello inline from the channel's input buffer without eager allocation based on protocol length fields. The vulnerability pattern (reading 24-bit handshake length and immediately allocating ctx.alloc().buffer(handshakeLength) before data arrives) does not exist in 4.0.56.Final.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Version 4.0.56.Final is not affected by CVE-2026-45416. The vulnerable classes SslClientHelloHandler and AbstractSniHandler do not exist in this version - they were introduced in Netty 4.1.x. The 4.0.x SniHandler uses a fundamentally different architecture that parses ClientHello inline from the channel's input buffer without eager allocation based on protocol length fields. The vulnerability pattern (reading 24-bit handshake length and immediately allocating ctx.alloc().buffer(handshakeLength) before data arrives) does not exist in 4.0.56.Final."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:07.216736+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.0.56.Final-tuxcare.2 of io.netty:netty-handler. Netty 4.0.56.Final (released 2018-02-05) pre-dates the introduction of the vulnerable fragmented ClientHello aggregation code by almost 2 years. The CVE-2026-75596 vulnerability exists in SslClientHelloHandler's handshakeBuffer.clear() + writeBytes() pattern, which causes quadratic CPU consumption. This class and mechanism were introduced in 2019-2020 for the 4.1.x branch. Version 4.0.56.Final uses a simpler SniHandler architecture that waits for complete TLS records and parses inline without any aggregation buffer, so the vulnerable code is not present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "impact_statement": "Netty 4.0.56.Final (released 2018-02-05) pre-dates the introduction of the vulnerable fragmented ClientHello aggregation code by almost 2 years. The CVE-2026-75596 vulnerability exists in SslClientHelloHandler's handshakeBuffer.clear() + writeBytes() pattern, which causes quadratic CPU consumption. This class and mechanism were introduced in 2019-2020 for the 4.1.x branch. Version 4.0.56.Final uses a simpler SniHandler architecture that waits for complete TLS records and parses inline without any aggregation buffer, so the vulnerable code is not present in this version."
    }
  ]
}