{
  "@id": "urn:uuid:f5ae0449-aede-47b6-83d2-50a8f2d178e5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 31,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:32:00.049964+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T18:06:31.685690+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages caused infinite BUFFER_OVERFLOW loops. Target Netty 4.1.115.Final has BUFFER_OVERFLOW handling (lines 1510-1521 in SslHandler.java) that allocates buffers of applicationBufferSize when overflow occurs, preventing the infinite retry loop. This defense was added in upstream commit 50fafdc3d3 (June 2012) by Trustin Lee, preda...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages caused infinite BUFFER_OVERFLOW loops. Target Netty 4.1.115.Final has BUFFER_OVERFLOW handling (lines 1510-1521 in SslHandler.java) that allocates buffers of applicationBufferSize when overflow occurs, preventing the infinite retry loop. This defense was added in upstream commit 50fafdc3d3 (June 2012) by Trustin Lee, preda..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:57.157354+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 is not present in Netty 4.1.115.Final-tuxcare.13. The vulnerability involved an infinite loop when SSL_write() returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The fix, which returns early from the wrap() method instead of breaking and potentially looping, was authored by Scott Mitchell (upstream Netty developer) in commit cd3bf3df58c (February 2017) and shipped in upstream Netty 4.1.1.Final and later releases. The target version (4.1.115.Final) inherited this fix from the upstream release that TuxCare onboarded, well before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is not present in Netty 4.1.115.Final-tuxcare.13. The vulnerability involved an infinite loop when SSL_write() returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The fix, which returns early from the wrap() method instead of breaking and potentially looping, was authored by Scott Mitchell (upstream Netty developer) in commit cd3bf3df58c (February 2017) and shipped in upstream Netty 4.1.1.Final and later releases. The target version (4.1.115.Final) inherited this fix from the upstream release that TuxCare onboarded, well before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:02:00.055561+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 does not affect version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.115.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.115.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 is NOT present in Netty 4.1.115.Final-tuxcare.13. The vulnerability (unbounded memory allocation in ZlibDecoders) was fixed in upstream commit 1543218d3e by Rich DiCroce in January 2020, which introduced the maxAllocation parameter and prepareDecompressBuffer() method to limit decompression buffer size. This fix was already present in the upstream Netty release before TuxCare onboarded this version. The target code contains the complete fix implementation across all three ZlibDecoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 is NOT present in Netty 4.1.115.Final-tuxcare.13. The vulnerability (unbounded memory allocation in ZlibDecoders) was fixed in upstream commit 1543218d3e by Rich DiCroce in January 2020, which introduced the maxAllocation parameter and prepareDecompressBuffer() method to limit decompression buffer size. This fix was already present in the upstream Netty release before TuxCare onboarded this version. The target code contains the complete fix implementation across all three ZlibDecoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:32:00.049964+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.115.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.115.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T12:20:26.492098+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 fix was already present in upstream Netty 4.1.115.Final release. The vulnerability (unvalidated ClientHello length allowing up to 16MB allocations) was fixed by commit 535da17e45 in June 2023, first shipped in netty-4.1.94.Final. The TuxCare 4.1.115.Final branch (November 2024 base) inherited this fix from upstream. The target contains the complete mitigation: maxClientHelloLengt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 fix was already present in upstream Netty 4.1.115.Final release. The vulnerability (unvalidated ClientHello length allowing up to 16MB allocations) was fixed by commit 535da17e45 in June 2023, first shipped in netty-4.1.94.Final. The TuxCare 4.1.115.Final branch (November 2024 base) inherited this fix from upstream. The target contains the complete mitigation: maxClientHelloLengt..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.115.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-16T01:17:00.135394+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-16T01:17:00.135394+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-16T01:17:00.135394+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.115.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.115.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.115.Final-tuxcare.8."
    }
  ]
}