{ "@id": "urn:uuid:8643daeb-c765-4816-9d17-d038c7c37003", "role": "Document Creator", "author": "https://tuxcare.com", "version": 25, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:12:34.459172+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T18:09:20.635929+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop DoS in Netty 3.x's SslHandler when processing SSLv2Hello messages requiring >30KB application buffers. The target (Netty 4.1.122.Final) contains the fix: when SSLEngine.unwrap() returns BUFFER_OVERFLOW, the code allocates a new buffer of the required size (handler/src/main/java/io/netty/handler/ssl/SslHandler.java:1526-1537) instead of retrying with the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop DoS in Netty 3.x's SslHandler when processing SSLv2Hello messages requiring >30KB application buffers. The target (Netty 4.1.122.Final) contains the fix: when SSLEngine.unwrap() returns BUFFER_OVERFLOW, the code allocates a new buffer of the required size (handler/src/main/java/io/netty/handler/ssl/SslHandler.java:1526-1537) instead of retrying with the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:40:27.887885+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 is NOT present in the target. The vulnerability (infinite loop when SSL_ERROR_WANT_READ is encountered with empty BIO buffer) was fixed in upstream commit 9e2c400f89 by Scott Mitchell on 2016-05-27. This fix was already included in upstream Netty version 4.1.1.Final, and the target version 4.1.122.Final (onboarded by TuxCare) inherited this fix from the upstream release. The code at ReferenceCountedOpenSslEngine.java:1002-1006 correctly handles SSL_ERROR_WANT_READ by returning to the event loop with NEED_UNWRAP status instead of continuing the local loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 is NOT present in the target. The vulnerability (infinite loop when SSL_ERROR_WANT_READ is encountered with empty BIO buffer) was fixed in upstream commit 9e2c400f89 by Scott Mitchell on 2016-05-27. This fix was already included in upstream Netty version 4.1.1.Final, and the target version 4.1.122.Final (onboarded by TuxCare) inherited this fix from the upstream release. The code at ReferenceCountedOpenSslEngine.java:1002-1006 correctly handles SSL_ERROR_WANT_READ by returning to the event loop with NEED_UNWRAP status instead of continuing the local loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler. The target Netty 4.1.122.Final contains the upstream fix for CVE-2020-11612. The ZlibDecoder classes include the maxAllocation protection mechanism that prevents unbounded memory allocation during decompression. This fix was authored by Rich DiCroce and shipped in upstream Netty 4.1.46.Final (released January 2020), well before the target version. TuxCare onboarded version 4.1.122.Final which already contained this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "The target Netty 4.1.122.Final contains the upstream fix for CVE-2020-11612. The ZlibDecoder classes include the maxAllocation protection mechanism that prevents unbounded memory allocation during decompression. This fix was authored by Rich DiCroce and shipped in upstream Netty 4.1.46.Final (released January 2020), well before the target version. TuxCare onboarded version 4.1.122.Final which already contained this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-7238 is NOT present in Netty 4.1.122.Final. The vulnerability allowed HTTP Request Smuggling via Transfer-Encoding headers with leading whitespace combined with Content-Length headers. The target contains TWO defenses: (1) Header name validation that rejects header names containing spaces (HttpUtil.validateToken), preventing \" Transfer-Encoding\" from being accepted; (2) Validation that rejects HTTP/1.1 messages with both Content-Length and Transfer-Encoding: chunked headers (HttpObjectDecoder lines 870-872, handleTransferEncodingChunkedWithContentLength). Both fixes were authored by upstream (Norman Maurer, Apple) and shipped in the upstream Netty 4.1.122.Final release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "CVE-2020-7238 is NOT present in Netty 4.1.122.Final. The vulnerability allowed HTTP Request Smuggling via Transfer-Encoding headers with leading whitespace combined with Content-Length headers. The target contains TWO defenses: (1) Header name validation that rejects header names containing spaces (HttpUtil.validateToken), preventing \" Transfer-Encoding\" from being accepted; (2) Validation that rejects HTTP/1.1 messages with both Content-Length and Transfer-Encoding: chunked headers (HttpObjectDecoder lines 870-872, handleTransferEncodingChunkedWithContentLength). Both fixes were authored by upstream (Norman Maurer, Apple) and shipped in the upstream Netty 4.1.122.Final release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-10-31T12:22:51.876137+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 fix is already present in target version 4.1.122.Final. The upstream fix (commit 535da17e) was included in the upstream 4.1.122.Final release before TuxCare onboarding. The target has complete protection: maxClientHelloLength validation in SslClientHelloHandler (defaults to 64KB) with TooLongFrameException thrown before buffer allocation when handshake length exceeds the limit. A...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 CVE-2023-34462 fix is already present in target version 4.1.122.Final. The upstream fix (commit 535da17e) was included in the upstream 4.1.122.Final release before TuxCare onboarding. The target has complete protection: maxClientHelloLength validation in SslClientHelloHandler (defaults to 64KB) with TooLongFrameException thrown before buffer allocation when handshake length exceeds the limit. A..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.122.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T11:59:19.723998+00:00", "status_notes": "Vulnerability CVE-2025-24970 does not affect version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler. Target version 4.1.122.Final is not affected by CVE-2025-24970. The vulnerability (improper handling of malformed SSL/TLS packets causing native crashes) was fixed by upstream Netty in commits 87f40725 (main fix, Feb 10 2025) and dc6b051d (follow-up, Feb 14 2025), both of which shipped in the upstream 4.1.122.Final release before TuxCare onboarded it (Aug 12 2026). The fixes add proper validation of buffer length before parsing SSL packet headers, preventing negative packet lengths and buffer underruns that could cause crashes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24970" }, "impact_statement": "Target version 4.1.122.Final is not affected by CVE-2025-24970. The vulnerability (improper handling of malformed SSL/TLS packets causing native crashes) was fixed by upstream Netty in commits 87f40725 (main fix, Feb 10 2025) and dc6b051d (follow-up, Feb 14 2025), both of which shipped in the upstream 4.1.122.Final release before TuxCare onboarded it (Aug 12 2026). The fixes add proper validation of buffer length before parsing SSL packet headers, preventing negative packet lengths and buffer underruns that could cause crashes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-45416" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.1.122.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.1.122.Final-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.1.122.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.1.122.Final-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.122.Final-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.122.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }