{
  "@id": "urn:uuid:c6ea7092-6645-4703-9287-a467c14b7556",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 26,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:34:00.158763+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2 due to infinite loop when processing SSLv2Hello messages. The target is Netty 4.1.108.Final, which uses a completely different architecture (io.netty vs org.jboss.netty packages). Netty 4.x already includes proper BUFFER_OVERFLOW handling in SslHandler that prevents the infinite loop vulnerability. The fix was added to Netty 4.x by upstream maintaine...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2 due to infinite loop when processing SSLv2Hello messages. The target is Netty 4.1.108.Final, which uses a completely different architecture (io.netty vs org.jboss.netty packages). Netty 4.x already includes proper BUFFER_OVERFLOW handling in SslHandler that prevents the infinite loop vulnerability. The fix was added to Netty 4.x by upstream maintaine..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:47:30.687322+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler. Target version 4.1.108.Final is not affected by CVE-2016-4970. The vulnerability (infinite loop in SSL_write error handling) was fixed in upstream Netty commit 9e2c400f89 by Scott Mitchell, which was already present in the upstream release when TuxCare onboarded version 4.1.108.Final. The fix ensures that when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer, the code returns control to the event loop instead of continuing to loop indefinitely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "Target version 4.1.108.Final is not affected by CVE-2016-4970. The vulnerability (infinite loop in SSL_write error handling) was fixed in upstream Netty commit 9e2c400f89 by Scott Mitchell, which was already present in the upstream release when TuxCare onboarded version 4.1.108.Final. The fix ensures that when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer, the code returns control to the event loop instead of continuing to loop indefinitely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46 due to unbounded memory allocation in ZlibDecoders. The target repository (Netty 4.1.108.Final) already contains the complete upstream fix introduced in commit 1543218d3e (PR #9924) by Rich DiCroce. The fix adds a configurable maxAllocation limit and prepareDecompressBuffer() method that enforces bounds checking on decompression buffers, throwing DecompressionException when limits are exceeded. All buffer allocations in JZlibDecoder and JdkZlibDecoder go through this protected method with no bypass paths. The fix was already present in the upstream 4.1.108.Final release that TuxCare onboarded, making this an upstream-provided defense rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46 due to unbounded memory allocation in ZlibDecoders. The target repository (Netty 4.1.108.Final) already contains the complete upstream fix introduced in commit 1543218d3e (PR #9924) by Rich DiCroce. The fix adds a configurable maxAllocation limit and prepareDecompressBuffer() method that enforces bounds checking on decompression buffers, throwing DecompressionException when limits are exceeded. All buffer allocations in JZlibDecoder and JdkZlibDecoder go through this protected method with no bypass paths. The fix was already present in the upstream 4.1.108.Final release that TuxCare onboarded, making this an upstream-provided defense rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:34:00.158763+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.108.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.108.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:48.255901+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 is NOT present in target version 4.1.108.Final-tuxcare.3. The vulnerability involved unbounded heap allocation in SniHandler based on attacker-controlled ClientHello handshake length. The upstream fix (commit 535da17e45 by norman_maurer@apple.com) added maxClientHelloLength validation and was already included in upstream Netty 4.1.108.Final before TuxCare onboarded it. The target...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 is NOT present in target version 4.1.108.Final-tuxcare.3. The vulnerability involved unbounded heap allocation in SniHandler based on attacker-controlled ClientHello handshake length. The upstream fix (commit 535da17e45 by norman_maurer@apple.com) added maxClientHelloLength validation and was already included in upstream Netty 4.1.108.Final before TuxCare onboarded it. The target..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.108.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-01T12:50:24.818091+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-01T12:50:24.818091+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-01T12:50:24.818091+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-01T12:50:24.818091+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-01T13:14:36.333041+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-01T12:50:24.818091+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-01T12:50:24.818091+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.108.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-01T12:50:24.818091+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.108.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}