{
  "@id": "urn:uuid:a1f03e1e-fe87-4f1e-8316-9996ce584558",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:31:00.049800+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:03:31.602360+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2, where SslHandler could enter an infinite loop when processing SSLv2Hello messages requiring >30KB application buffers. Netty 4.1.112.Final is not affected - the vulnerability pattern is not present. The Netty 4.x architecture includes proper BUFFER_OVERFLOW handling (SslHandler.java:1480-1491) that allocates appropriately sized buffers when SSLEngin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2, where SslHandler could enter an infinite loop when processing SSLv2Hello messages requiring >30KB application buffers. Netty 4.1.112.Final is not affected - the vulnerability pattern is not present. The Netty 4.x architecture includes proper BUFFER_OVERFLOW handling (SslHandler.java:1480-1491) that allocates appropriately sized buffers when SSLEngin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:59.702907+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target repository is at version 4.1.112.Final, which already contains the upstream fix. The vulnerability caused an infinite loop when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no pending BIO data. The target's ReferenceCountedOpenSslEngine.java (lines 1002-1025) implements the fix by returning early with appropriate status codes instead of continuing the loop. The fix was introduced in upstream commit cd3bf3df58c by Scott Mitchell (2017-02-14) and shipped with the upstream 4.1.112.Final release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target repository is at version 4.1.112.Final, which already contains the upstream fix. The vulnerability caused an infinite loop when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no pending BIO data. The target's ReferenceCountedOpenSslEngine.java (lines 1002-1025) implements the fix by returning early with appropriate status codes instead of continuing the loop. The fix was introduced in upstream commit cd3bf3df58c by Scott Mitchell (2017-02-14) and shipped with the upstream 4.1.112.Final release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler. The target repository (Netty 4.1.112.Final-tuxcare.6) is NOT AFFECTED by CVE-2020-11612. The vulnerability affects Netty versions before 4.1.46, and the fix for unbounded memory allocation in ZlibDecoders was introduced in upstream commit 1543218d3e (Jan 31, 2020) by Rich DiCroce. This fix was already present in the upstream 4.1.112.Final release when TuxCare onboarded it. All three decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) contain the maxAllocation limiting mechanism that prevents unbounded memory allocation during decompression.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target repository (Netty 4.1.112.Final-tuxcare.6) is NOT AFFECTED by CVE-2020-11612. The vulnerability affects Netty versions before 4.1.46, and the fix for unbounded memory allocation in ZlibDecoders was introduced in upstream commit 1543218d3e (Jan 31, 2020) by Rich DiCroce. This fix was already present in the upstream 4.1.112.Final release when TuxCare onboarded it. All three decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) contain the maxAllocation limiting mechanism that prevents unbounded memory allocation during decompression.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T18:31:00.049800+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.112.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.112.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T12:19:00.101475+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 does not affect this version. The vulnerability allowed SniHandler to allocate up to 16MB of heap per connection without limit. The fix (upstream commit 535da17e45 by Norman Maurer) adds maxClientHelloLength validation with a safe 64KB default, rejecting oversized ClientHello messages. This fix was already present in upstream Netty 4.1.112.Final when TuxCare onboarded it (first T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 does not affect this version. The vulnerability allowed SniHandler to allocate up to 16MB of heap per connection without limit. The fix (upstream commit 535da17e45 by Norman Maurer) adds maxClientHelloLength validation with a safe 64KB default, rejecting oversized ClientHello messages. This fix was already present in upstream Netty 4.1.112.Final when TuxCare onboarded it (first T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.112.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.112.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.112.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.112.Final-tuxcare.6."
    }
  ]
}