{
  "@id": "urn:uuid:2ebe8dd0-71ff-4054-9e09-cb440553a578",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:31:00.049800+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:05:00.309631+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2, causing infinite loops when SSLv2Hello messages require buffers larger than the default pool size. The target (Netty 4.1.107.Final) is NOT AFFECTED because it contains an upstream fix from July 2015 (commit 9660e2f6a98 by Norman Maurer) that handles BUFFER_OVERFLOW by dynamically allocating appropriately-sized buffers based on engine.getSession().ge...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2, causing infinite loops when SSLv2Hello messages require buffers larger than the default pool size. The target (Netty 4.1.107.Final) is NOT AFFECTED because it contains an upstream fix from July 2015 (commit 9660e2f6a98 by Norman Maurer) that handles BUFFER_OVERFLOW by dynamically allocating appropriately-sized buffers based on engine.getSession().ge..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version is 4.1.107.Final, which is significantly newer than the affected versions. The vulnerability involved an infinite loop when OpenSSL's SSL_write returned SSL_ERROR_WANT_READ with no data in the BIO buffer. The fix (commit 9e2c400f89) was authored by upstream Netty developer Scott Mitchell and was already present in the upstream 4.1.107.Final release that TuxCare onboarded. The code now properly returns to the event loop instead of continuing to loop, preventing the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version is 4.1.107.Final, which is significantly newer than the affected versions. The vulnerability involved an infinite loop when OpenSSL's SSL_write returned SSL_ERROR_WANT_READ with no data in the BIO buffer. The fix (commit 9e2c400f89) was authored by upstream Netty developer Scott Mitchell and was already present in the upstream 4.1.107.Final release that TuxCare onboarded. The code now properly returns to the event loop instead of continuing to loop, preventing the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-11612 is NOT present in target Netty 4.1.107.Final. The vulnerability (unbounded memory allocation in ZlibDecoders) was fixed by upstream Netty in commit 1543218d3e (Jan 2020) which added a configurable maxAllocation limit with enforcement via prepareDecompressBuffer(). This fix was included in Netty 4.1.46.Final and all subsequent releases. The target version 4.1.107.Final already contains this upstream fix in the release that TuxCare onboarded. The defense mechanism (maxAllocation field, prepareDecompressBuffer() method with size limit enforcement) is fully present in ZlibDecoder, JZlibDecoder, and JdkZlibDecoder classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 is NOT present in target Netty 4.1.107.Final. The vulnerability (unbounded memory allocation in ZlibDecoders) was fixed by upstream Netty in commit 1543218d3e (Jan 2020) which added a configurable maxAllocation limit with enforcement via prepareDecompressBuffer(). This fix was included in Netty 4.1.46.Final and all subsequent releases. The target version 4.1.107.Final already contains this upstream fix in the release that TuxCare onboarded. The defense mechanism (maxAllocation field, prepareDecompressBuffer() method with size limit enforcement) is fully present in ZlibDecoder, JZlibDecoder, and JdkZlibDecoder classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:31:00.049800+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.107.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.107.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:16:43.502560+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 Target Netty 4.1.107.Final is NOT AFFECTED by CVE-2023-34462. The fix for unbounded ClientHello buffer allocation was already present in the upstream Netty 4.1.107.Final release. The validation code that prevents excessive heap allocation (up to 16MB) during TLS handshake is present in SslClientHelloHandler.java with a secure 64KB default limit. This version is actually MORE secure than some ba...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Target Netty 4.1.107.Final is NOT AFFECTED by CVE-2023-34462. The fix for unbounded ClientHello buffer allocation was already present in the upstream Netty 4.1.107.Final release. The validation code that prevents excessive heap allocation (up to 16MB) during TLS handshake is present in SslClientHelloHandler.java with a secure 64KB default limit. This version is actually MORE secure than some ba..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.107.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T12:02:29.846725+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.107.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.107.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}