{ "@id": "urn:uuid:055850c6-fd18-4e12-ab9d-314a73ee2447", "role": "Document Creator", "author": "https://tuxcare.com", "version": 29, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T18:03:00.046051+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T18:10:49.355922+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 The target repository (Netty 4.1.135.Final) is not affected by CVE-2014-3488. The vulnerability (infinite loop caused by SSLv2Hello messages requiring >30KB application buffer) was fixed in upstream Netty 4.x before TuxCare onboarded this version. The fix handles BUFFER_OVERFLOW by dynamically allocating appropriately-sized buffers based on SSLEngine.getSession().getApplicationBufferSize(), pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.135.Final) is not affected by CVE-2014-3488. The vulnerability (infinite loop caused by SSLv2Hello messages requiring >30KB application buffer) was fixed in upstream Netty 4.x before TuxCare onboarded this version. The fix handles BUFFER_OVERFLOW by dynamically allocating appropriately-sized buffers based on SSLEngine.getSession().getApplicationBufferSize(), pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T12:43:21.485909+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. The target repository (Netty 4.1.135.Final-tuxcare.1) is not affected by CVE-2016-4970. This vulnerability, which caused an infinite loop in OpenSslEngine.wrap() when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer, was fixed in upstream Netty 4.1.1.Final (released May 27, 2016). The target version 4.1.135.Final is significantly newer and includes the upstream fix. The fix commit (9e2c400f89c5badc39919f811179d3d42ac5257c) by Scott Mitchell from Apple is an ancestor of the TuxCare onboarding commit, confirming it was shipped in the upstream release. Analysis of the current code in ReferenceCountedOpenSslEngine.java shows that the vulnerable pattern (breaking from error handling and continuing the loop) is absent - the code immediately returns when these error conditions occur, preventing the infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "The target repository (Netty 4.1.135.Final-tuxcare.1) is not affected by CVE-2016-4970. This vulnerability, which caused an infinite loop in OpenSslEngine.wrap() when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer, was fixed in upstream Netty 4.1.1.Final (released May 27, 2016). The target version 4.1.135.Final is significantly newer and includes the upstream fix. The fix commit (9e2c400f89c5badc39919f811179d3d42ac5257c) by Scott Mitchell from Apple is an ancestor of the TuxCare onboarding commit, confirming it was shipped in the upstream release. Analysis of the current code in ReferenceCountedOpenSslEngine.java shows that the vulnerable pattern (breaking from error handling and continuing the loop) is absent - the code immediately returns when these error conditions occur, preventing the infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-06T18:03:00.046051+00:00", "status_notes": "Vulnerability CVE-2019-20445 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. Prechecker: The upstream fix is already in this version's source history (commits 5f688978, 62903462, 8494b046). The upstream fix was released in 4.1.45, and version 4.1.135.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20445" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 5f688978, 62903462, 8494b046). The upstream fix was released in 4.1.45, and version 4.1.135.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. CVE-2020-11612 is NOT present in Netty 4.1.135.Final-tuxcare.1. The vulnerability concerns unbounded memory allocation in ZlibDecoders when processing compressed byte streams. The upstream fix (commit 1543218d3e, authored by Rich.DiCroce@scientificgames.com) introduced a configurable maxAllocation parameter to limit decompression buffer size, which was already included in the upstream 4.1.135.Final release that TuxCare onboarded. All three decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) contain the complete fix with prepareDecompressBuffer() method and maxAllocation support.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "CVE-2020-11612 is NOT present in Netty 4.1.135.Final-tuxcare.1. The vulnerability concerns unbounded memory allocation in ZlibDecoders when processing compressed byte streams. The upstream fix (commit 1543218d3e, authored by Rich.DiCroce@scientificgames.com) introduced a configurable maxAllocation parameter to limit decompression buffer size, which was already included in the upstream 4.1.135.Final release that TuxCare onboarded. All three decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) contain the complete fix with prepareDecompressBuffer() method and maxAllocation support.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. Target version 4.1.135.Final is not affected by CVE-2020-7238. The vulnerability was fixed in upstream commit 8494b046ec authored by Norman Maurer (norman_maurer@apple.com), which was already present in the upstream 4.1.135.Final release when TuxCare onboarded it (first TuxCare commit: a1ddbe0874). The fix adds validation to reject HTTP/1.1 requests containing multiple Content-Length headers or both Transfer-Encoding: chunked and Content-Length headers, preventing HTTP request smuggling attacks. The defenses are active by default (allowDuplicateContentLengths=false, useRfc9112TransferEncoding=true).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "Target version 4.1.135.Final is not affected by CVE-2020-7238. The vulnerability was fixed in upstream commit 8494b046ec authored by Norman Maurer (norman_maurer@apple.com), which was already present in the upstream 4.1.135.Final release when TuxCare onboarded it (first TuxCare commit: a1ddbe0874). The fix adds validation to reject HTTP/1.1 requests containing multiple Content-Length headers or both Transfer-Encoding: chunked and Content-Length headers, preventing HTTP request smuggling attacks. The defenses are active by default (allowDuplicateContentLengths=false, useRfc9112TransferEncoding=true).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T12:24:18.145566+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 does not affect Netty 4.1.135.Final-tuxcare.1. The vulnerability describes unbounded heap allocation in SniHandler during TLS handshake, allowing up to 16MB allocation per ClientHello without validation. The upstream fix (commit 535da17e45201ae4278c0479e6162bb4127d4c32 by Norman Maurer) was already present in Netty 4.1.135.Final before TuxCare onboarded this version. The fix adds...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 CVE-2023-34462 does not affect Netty 4.1.135.Final-tuxcare.1. The vulnerability describes unbounded heap allocation in SniHandler during TLS handshake, allowing up to 16MB allocation per ClientHello without validation. The upstream fix (commit 535da17e45201ae4278c0479e6162bb4127d4c32 by Norman Maurer) was already present in Netty 4.1.135.Final before TuxCare onboarded this version. The fix adds..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.135.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T12:00:45.012229+00:00", "status_notes": "Vulnerability CVE-2025-24970 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. CVE-2025-24970 is NOT present in Netty 4.1.135.Final-tuxcare.1. All security fixes for this vulnerability were already included in the upstream Netty 4.1.135.Final release (released 2026-06-02) that TuxCare onboarded. The vulnerable code pattern has been replaced with proper validation logic that prevents native crashes from malformed SSL/TLS packets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24970" }, "impact_statement": "CVE-2025-24970 is NOT present in Netty 4.1.135.Final-tuxcare.1. All security fixes for this vulnerability were already included in the upstream Netty 4.1.135.Final release (released 2026-06-02) that TuxCare onboarded. The vulnerable code pattern has been replaced with proper validation logic that prevents native crashes from malformed SSL/TLS packets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T12:02:52.397356+00:00", "status_notes": "Vulnerability CVE-2026-50010 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. The target Netty 4.1.135.Final is not affected by CVE-2026-50010. The upstream fix (commit 09e72c4fd8) was merged on June 1, 2026, and the 4.1.135.Final release was created on June 2, 2026, meaning the vulnerability was already fixed in the upstream release before TuxCare onboarded it on July 13, 2026. The vulnerable wrapping code that silently disabled hostname verification has been removed from SimpleTrustManagerFactory.engineGetTrustManagers().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final), NVD (< 4.1.135; >= 4.2.0, < 4.2.15), cve.org (>= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final), Snyk (< 4.1.135.Final; >= 4.2.0.Alpha1, < 4.2.15.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50010" }, "impact_statement": "The target Netty 4.1.135.Final is not affected by CVE-2026-50010. The upstream fix (commit 09e72c4fd8) was merged on June 1, 2026, and the 4.1.135.Final release was created on June 2, 2026, meaning the vulnerability was already fixed in the upstream release before TuxCare onboarded it on July 13, 2026. The vulnerable wrapping code that silently disabled hostname verification has been removed from SimpleTrustManagerFactory.engineGetTrustManagers().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final), NVD (< 4.1.135; >= 4.2.0, < 4.2.15), cve.org (>= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final), Snyk (< 4.1.135.Final; >= 4.2.0.Alpha1, < 4.2.15.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }